docker.yml

---
name: Build and Push Docker Image on Release

on:
  release:
    types: [published]

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    concurrency:
      group: docker

    permissions:
      id-token: write
      contents: read
      attestations: write
      packages: write

    steps:
    - name: Checkout code
      uses: actions/checkout@v5
    
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    
    - name: Login to GitHub Container Registry
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Set lowercase repository name
      run: |
        echo "REPO_LC=${GITHUB_REPOSITORY,,}" >> ${GITHUB_ENV}

    - name: Extract release version
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ghcr.io/${{ env.REPO_LC }}
        tags: |
          type=semver,pattern=v{{version}}
          type=semver,pattern=v{{major}}.{{minor}}.{{patch}}

    - name: Set up build args
      id: build-args
      run: |
        echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
        echo "GIT_COMMIT=${GITHUB_SHA:0:7}" >> $GITHUB_OUTPUT

    - name: Build and push Docker image
      id: push
      uses: docker/build-push-action@v6
      with:
        context: .
        push: true
        platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64,linux/ppc64le,linux/riscv64
        tags: ${{ steps.meta.outputs.tags }}
        build-args: |
          BUILD_DATE=${{ steps.build-args.outputs.BUILD_DATE }}
          GIT_COMMIT=${{ steps.build-args.outputs.GIT_COMMIT }}

    - name: Generate artifact attestation
      uses: actions/attest-build-provenance@v3
      with:
        subject-name: ghcr.io/${{ env.REPO_LC }}
        subject-digest: ${{ steps.push.outputs.digest }}
        push-to-registry: true