docker.yml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
#
# Build the domarinn container and publish it to GHCR.
#
# The heavy lifting (per-platform runner split, manifest-list merge, SBOM
# attestation, cosign signing, cache wiring) is delegated to Docker's own
# reusable build workflow rather than hand-rolled here. Its default `runner`
# mapping already sends linux/arm64 legs to ubuntu-24.04-arm, so multi-arch is
# a platform list rather than a matrix plus a digest-shuffling merge job.
#
# Tags: `rolling` tracks main; a published release produces semver tags
# (1.2.3, 1.2, 1). There is deliberately no `latest` — pin a version or track
# `rolling`, but do not let an unpinned tag silently jump a major.
#
# Auth is the built-in GITHUB_TOKEN: GHCR accepts it, so this workflow needs
# no registry secrets at all.
name: Docker

on:
  push:
    branches: [main]
  release:
    types: [published]
  workflow_dispatch:

concurrency:
  group: docker-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name != 'release' }}

jobs:
  image:
    name: Build and push
    permissions:
      contents: read
      # id-token lets the reusable workflow mint an OIDC token for keyless
      # cosign signing; packages is what actually authorises the GHCR push.
      id-token: write
      packages: write
    uses: docker/github-builder/.github/workflows/build.yml@a492c6d04fd3315f67230809b44d60cc0acd50b3 # v1.16.0
    with:
      context: .
      file: Dockerfile
      output: image
      push: true
      platforms: linux/amd64,linux/arm64
      sbom: true
      sign: "true"
      cache: true
      cache-scope: domarinn
      cache-mode: max
      # Lowercase literal, not ghcr.io/${{ github.repository }}: GHCR rejects
      # uppercase path segments and the org name is mixed-case.
      meta-images: ghcr.io/atviksecurity/domarinn
      meta-flavor: latest=false
      meta-tags: |
        type=semver,pattern={{version}}
        type=semver,pattern={{major}}.{{minor}}
        type=semver,pattern={{major}}
        type=raw,value=rolling,enable={{is_default_branch}}
      meta-labels: |
        org.opencontainers.image.vendor=Atvik Security
      set-meta-labels: true
      set-meta-annotations: true
    secrets:
      registry-auths: |
        - registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}