hanna/fabrica

ci(docker): build and publish the image to GHCR

452b717 · hanna committed on 2026-07-26

Add a workflow that builds the container image and pushes it to
ghcr.io/<owner>/<repo> on every push to main and every v* tag (plus manual
dispatch). Tags cover latest, the branch, semver, and the short SHA; builds use
the built-in GITHUB_TOKEN and a GHA layer cache. linux/amd64 only — the Rust
build is too heavy for QEMU-emulated arm64.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

.github/workflows/docker.yml +72 −0

@@ @@ -0,0 +1,72 @@ @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.
+#
 # Build the container image and publish it to the GitHub Container Registry
 # (ghcr.io/<owner>/<repo>) on every push to main and every version tag.
 name: docker
 on:
   push:
     branches: [main]
     tags: ["v*"]
   workflow_dispatch:
 # One in-flight build per ref; a newer push cancels the older run.
 concurrency:
   group: docker-${{ github.ref }}
   cancel-in-progress: true
 jobs:
   build:
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write # push to GHCR with the built-in GITHUB_TOKEN
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       # Only authenticate when we intend to push (not on manual dry-runs of forks).
       - name: Log in to GHCR
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Derive image tags and labels
         id: meta
         uses: docker/metadata-action@v5
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
             type=ref,event=branch
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
             type=raw,value=latest,enable={{is_default_branch}}
             type=sha,format=short
       - name: Build and push
         uses: docker/build-push-action@v6
         with:
           context: .
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           # linux/amd64 only: the image compiles the whole Rust workspace
           # (aws-lc-sys, vendored libgit2), so a QEMU-emulated arm64 build would
           # be prohibitively slow. Add linux/arm64 here with a native arm runner
           # if you need it.
           platforms: linux/amd64
           # A single-arch manifest — skip the extra provenance attestation that
           # otherwise adds an "unknown/unknown" entry to the package listing.
           provenance: false
           cache-from: type=gha
           cache-to: type=gha,mode=max