Lab 10: release to ghcr.io and deploy to Hugging Face Spaces

[Dekart-hub]

Goal

Push the QuickNotes image to ghcr.io from a tag-triggered CI release, serve the same image publicly from a Hugging Face Space with measured warm and cold latency, and (bonus) compare it against a Cloudflare quick tunnel exposing a local copy.

Changes

• .github/workflows/release.yml: fires on v* tags, permissions limited to contents: read plus packages: write, every action pinned by 40-char SHA, buildx builds linux/amd64 + linux/arm64 and pushes the version tag plus latest to ghcr.io/dekart-hub/devops-intro/quicknotes
• cloud/hf-space/: the Space files
  • Dockerfile: pulls the released v0.1.0 image, so the public URL serves the exact artifact Lab 9 scanned; DATA_PATH moved to /tmp for arbitrary-uid safety
  • README.md: Docker SDK frontmatter with app_port: 8080 (QuickNotes listens on 8080, HF defaults to 7860)
• cloud/teardown.md: cleanup notes for both targets
• submissions/lab10.md: release evidence, Space deployment and measurements, tunnel comparison table, design questions a-i
• The branch carries the Lab 9 app hardening and CI gate, so the released image is the hardened one

Testing

• Signed tag v0.1.0 fired the release; green run: https://github.com/Dekart-hub/DevOps-Intro/actions/runs/28658814522
• Image publicly pullable with no credentials (docker logout then pull, plus an anonymous registry token manifest check); both platforms present in the manifest
• Space serves /health and /notes at https://dekarters-quicknotes.hf.space, Lab 9 security headers included
• Warm p50 384 ms / p95 616 ms (hyperfine, 50 runs); cold start 10-13 s across 3 forced down-up cycles (free tier now sleeps only after 48 h, method documented in the report)
• Tunnel bonus: reachable from a phone on cellular; warm p50 257 ms / p95 285 ms; comparison table filled from real measurements

Checklist

• Title is a clear sentence (<= 70 chars)
• Commits are signed (git log --show-signature)
• submissions/lab10.md updated