publish support

.github/workflows/docker.yml

@@ -0,0 +1,71 @@
+name: Publish to Dockerhub
+on:
+  push:
+    branches:
+      - chore/docker_build
+      - main
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+'
+
+env:
+  REGISTRY: docker.io
+  IMAGE_NAME: tokendito/tokendito
+
+jobs:
+  dockerhubpublish:
+    name: Build and Publish Docker Container
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      max-parallel: 2
+      matrix:
+        include:
+          - { platform: "linux/arm64", platform-tag: "arm64" }
+          - { platform: "linux/amd64", platform-tag: "amd64" }
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v3
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v2
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v2
+    - name: Login to Docker Hub
+      uses: docker/login-action@v2
+      with:
+        username: tokendito
+        password: ${{ secrets.DOCKERHUB_TOKEN }}
+    - name: Extract Docker metadata
+      id: meta
+      uses: docker/metadata-action@v4
+      with:
+        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+        tags: |
+          type=ref,event=branch
+          type=ref,event=pr
+          type=semver,pattern={{version}}
+          type=semver,pattern={{major}}.{{minor}}
+    - name: Build container
+      uses: docker/build-push-action@v4
+      with:
+        context: .
+        push: false
+        load: true
+        platforms: ${{ matrix.platform }}
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+      env:
+        DOCKER_CONTENT_TRUST: 1
+    - name: Sign and push container image
+      uses: sudo-bot/action-docker-sign@latest
+      if: github.event_name != 'pull_request'
+      with:
+        image-ref: "${{ steps.meta.outputs.tags }}"
+        private-key-id: "${{ secrets.DOCKER_PRIVATE_KEY_ID }}"
+        private-key: "${{ secrets.DOCKER_PRIVATE_KEY }}"
+        private-key-passphrase: "${{ secrets.DOCKER_PRIVATE_KEY_PASSPHRASE }}"