v0.0.10

Added a root-level Dockerfile using a three-stage multi-stage build:
- Stage 1 uses node:20-alpine to build the web/default-pro frontend;
- Stage 2 uses golang:1.22-alpine, builds the Go binary statically with CGO_ENABLED=0 (the project uses the pure-Go glebarez/sqlite, so no CGO toolchain is needed), and auto-downloads the go.mod-declared 1.25 toolchain via GOTOOLCHAIN=auto;
- Stage 3 uses alpine:latest as the runtime base, installing only ca-certificates, tzdata, and wget for a small, secure footprint.
Runs as non-root user app by default, ships with an HTTP health check against /api/status, and declares VOLUME [/app/config, /app/data].
Default environment variables: PORT=3000, LOG_DIR=/app/data/logs, SQLITE_PATH=/app/data/one-api-pro.db, CONFIG_DIR=/app/config.

New docker-entrypoint.sh serves as the container ENTRYPOINT and provides three behaviors:
1. Auto-load $CONFIG_DIR/.env: if the file exists at startup it is forwarded to one-api-pro as --env <path>, so users can mount a .env and have it take effect without touching the docker run command;
2. CLI argument passthrough: arguments such as docker run image --port 8080 --log-dir /xxx are forwarded verbatim to one-api-pro;
3. Debug passthrough: when the CMD's first argument is neither one-api-pro nor its absolute path (e.g. docker run image bash), the entrypoint execs the user-provided command directly so it is easy to drop into a shell.
Uses exec to replace the current process so that signals such as SIGTERM are correctly delivered to one-api-pro.

Added .github/workflows/release-docker.yml, decoupled from the existing release.yml (binary release):
- Triggers: push of any tag matching v*.*.*, or manual workflow_dispatch (with optional tag input);
- Enforces that CHANGELOG/<tag>.md exists, keeping the release process consistent with release.yml;
- Enables multi-arch builds via docker/setup-qemu-action + docker/setup-buildx-action, producing linux/amd64 and linux/arm64 images in parallel;
- Uses docker/metadata-action to auto-generate semver tags (:0.0.10, :0.0, :0); the latest=auto flavor skips pre-release suffixes (e.g. -rc, -beta);
- Injects OCI metadata: org.opencontainers.image.{title,description,source,licenses,revision,created};
- Enables GHA layer caching (cache-from: type=gha / cache-to: type=gha,mode=max) so subsequent builds reuse cached layers in seconds;
- Logs in to ghcr.io directly with ${{ secrets.GITHUB_TOKEN }} — no extra PAT needed;
- After build/push, calls gh api to PATCH either /users/{owner}/packages/container/{repo} or /orgs/{owner}/packages/container/{repo} to flip the package visibility to public; continue-on-error: true ensures that a permission failure never blocks the image push.
Added .dockerignore: aligned with .gitignore to exclude .git, .github, node_modules, dist, logs, *.db, the deprecated web/air / web/berry / web/default themes, and other build artifacts.

This is a purely engineering / CI / documentation release — no backend code changes, no database migration, safe to upgrade.
Existing binary users are completely unaffected: the binary deployment flow is unchanged.
After the first Docker image is published, please verify on the GitHub repo's Packages page that the package is public (the CI attempts this automatically; some organization repositories may require a maintainer to confirm).
docker-compose users should run docker compose pull && docker compose up -d to pull the new image and restart.

v0.0.10 ​