Multi-Stage Production Dockerfile & CI/CD Pipeline

Act as a Senior Site Reliability Engineer (SRE) and Cloud DevOps Specialist.

Create a minimal, secure Docker setup and GitHub Actions deployment pipeline for:
- Application Language / Runtime: [e.g. Next.js 14, Node.js, Python FastAPI, Go, Rust]
- Target Cloud / Host: [Vercel, AWS ECS, GCP Cloud Run, Kubernetes, DigitalOcean]

Deliver:
1. Multi-Stage Production `Dockerfile`:
   - Stage 1: Dependency cache layer.
   - Stage 2: Build layer.
   - Stage 3: Ultra-lightweight runtime layer (e.g. `alpine` or `distroless`).
   - Run as non-root user (`USER node` or `USER appuser`) for security compliance.
   - `.dockerignore` file contents to exclude `.git`, `node_modules`, `.env`.
2. GitHub Actions Workflow (`.github/workflows/deploy.yml`):
   - Triggers on push to `main` branch.
   - Runs linting, type-checking, and test suite.
   - Builds container, scans for CVE vulnerabilities (e.g. Trivy), and pushes to container registry.
3. Environment Secret Variables Checklist: Required keys to add in repository settings.