container-publish.yml

name: Container publish

on:
  push:
    branches:
      - main
      - feat/ghcr-publishing

permissions:
  contents: read

jobs:
  publish:
    name: Publish multi-architecture image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Generate image metadata
        id: metadata
        shell: bash
        run: |
          image="ghcr.io/${GITHUB_REPOSITORY,,}"
          short_sha="${GITHUB_SHA::7}"
          if [[ "${GITHUB_REF_NAME}" == "main" ]]; then
            release_tag="latest"
          else
            release_tag="${GITHUB_REF_NAME//\//-}"
          fi

          {
            echo "image=${image}"
            echo "tags<<EOF"
            echo "${image}:${release_tag}"
            echo "${image}:sha-${short_sha}"
            echo "EOF"
          } >> "${GITHUB_OUTPUT}"

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and publish image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.metadata.outputs.tags }}
          labels: |
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max