chore: implement hourly reset CronJob for prod and UAT

- Add ALLOW_RESET env var override to reset.ts safety guard
- Add reset Docker build target to Dockerfile
- Add reset image build step to CI docker job
- Add reset image tag update to CD job dev overlay update

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/ci.yml

@@ -188,6 +188,19 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Build and push Reset image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: apps/api/Dockerfile
+          target: reset
+          push: true
+          tags: |
+            ghcr.io/groombook/reset:${{ steps.version.outputs.tag }}
+            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/reset:latest' || '' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
       - name: Build and push Web image
         uses: docker/build-push-action@v6
         with:
@@ -356,6 +369,7 @@ jobs:
           yq -i '(.images[] | select(.name == "ghcr.io/groombook/web")).newTag = env(TAG)' "$DEV_KUST"
           yq -i '(.images[] | select(.name == "ghcr.io/groombook/migrate")).newTag = env(TAG)' "$DEV_KUST"
           yq -i '(.images[] | select(.name == "ghcr.io/groombook/seed")).newTag = env(TAG)' "$DEV_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/reset")).newTag = env(TAG)' "$DEV_KUST"
 
           # Update migrate Job name to include short SHA (immutable template fix)
           MIGRATE_JOB="apps/groombook/base/migrate-job.yaml"

apps/api/Dockerfile

@@ -43,3 +43,7 @@ CMD ["pnpm", "db:migrate"]
 # Seed stage — populates the database with test data
 FROM builder AS seed
 CMD ["pnpm", "db:seed"]
+
+# Reset stage — drops all tables, re-runs migrations, and re-seeds
+FROM builder AS reset
+CMD ["pnpm", "db:reset"]

packages/db/src/reset.ts

@@ -16,8 +16,8 @@ async function reset() {
     process.exit(1);
   }
 
-  if (process.env.NODE_ENV === "production") {
-    console.error("[FATAL] db:reset must not be run in production.");
+  if (process.env.NODE_ENV === "production" && process.env.ALLOW_RESET !== "true") {
+    console.error("[FATAL] db:reset must not be run in production without ALLOW_RESET=true.");
     process.exit(1);
   }