publish-docker.yml

name: Build and Publish Docker Image

on:
  workflow_dispatch:
  push:
    branches:
      - main
  release:
    types: [published]

jobs:
  docker:
    permissions:
      contents: read
      packages: write
      # permissions needed for attestations
      id-token: write
      attestations: write
    runs-on: ubuntu-latest
    steps:
    -
      name: Checkout
      uses: actions/checkout@v4
    -
      name: Set up QEMU
      uses: docker/setup-qemu-action@v3
    -
      name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    -
      name: Login to Docker Hub
      uses: docker/login-action@v3
      with:
        username: ${{ vars.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}
    -
      name: Login to GitHub Container Registry
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GITHUB_TOKEN }}
    -
      name: Update Docker Hub description
      uses: peter-evans/dockerhub-description@e98e4d1628a5f3be2be7c231e50981aee98723ae
      with:
        username: ${{ vars.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}
        repository: ${{ vars.DOCKERHUB_USERNAME }}/${{ vars.IMAGE_NAME }}
        short-description: ${{ github.event.repository.description }}
    -
      name: Build Docker meta data
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: |
          ${{ vars.DOCKERHUB_USERNAME }}/${{ vars.IMAGE_NAME }}
          ghcr.io/${{ github.repository_owner }}/${{ vars.IMAGE_NAME }}
        flavor: |
          latest=${{ github.event_name == 'release' && github.event.release.prerelease == false }}
        tags: |
          type=match,pattern=^v?((?:\d+\.){3}\d+),group=1  # 0.4.8.13
          type=match,pattern=^v?(.*),group=1               # 0.4.8.13-docker.1
          type=sha                                         # sha-4e91d87
    -
      name: Build and push Docker image
      uses: docker/build-push-action@v6
      id: push
      with:
        context: .
        file: ./Dockerfile
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        cache-from: type=gha
        cache-to: type=gha,mode=max
        platforms: linux/amd64
    -
      name: Attest DockerHub
      uses: actions/attest-build-provenance@v2
      with:
        subject-name: docker.io/${{ vars.DOCKERHUB_USERNAME }}/${{ vars.IMAGE_NAME }}
        subject-digest: ${{ steps.push.outputs.digest }}
        push-to-registry: true
    -
      name: Attest ghcr
      uses: actions/attest-build-provenance@v2
      with:
        subject-name: ghcr.io/${{ github.repository_owner }}/${{ vars.IMAGE_NAME }}
        subject-digest: ${{ steps.push.outputs.digest }}
        push-to-registry: true
    -
      name: Generate job summary
      id: job-summary
      run: |
        {
          IFS=$'\n'
          echo "## Docker tags"
          echo '```'
          for LINE in ${DOCKER_METADATA_OUTPUT_TAGS}; do echo "${LINE}"; done
          echo '```'
        } >> $GITHUB_STEP_SUMMARY