Skip to content

Add Docker image publishing to release workflow - #73

Merged
andrewring merged 6 commits into
mainfrom
dev/andrewring/docker-release
Jun 16, 2026
Merged

Add Docker image publishing to release workflow#73
andrewring merged 6 commits into
mainfrom
dev/andrewring/docker-release

Conversation

@andrewring

@andrewring andrewring commented Jun 16, 2026

Copy link
Copy Markdown
Owner

Summary

Adds multi-arch Docker image publishing to GHCR as part of the release workflow.

  • Reuses the already-built static Linux (musl) binaries from the build matrix — no Rust compilation inside Docker
  • Minimal scratch-based Dockerfile (4 lines)
  • Multi-arch: linux/amd64 and linux/arm64
  • Images published to ghcr.io/andrewring/github-distributed-owners
  • Semver tags via docker/metadata-action: 0.1.12, 0.1, 0
  • Runs in parallel with the binary upload job
  • Least-privilege permissions: contents: read + packages: write
  • Renames workflow from "Release Binaries" to "Release"

One-time setup after first push

  1. Go to https://github.com/andrewring?tab=packages
  2. Click the github-distributed-owners package
  3. Package Settings → Danger Zone → Change visibility → Public

Test plan

  • Run workflow via workflow_dispatch for a tag and verify image appears in GHCR
  • Verify multi-arch: docker manifest inspect ghcr.io/andrewring/github-distributed-owners:<tag>
  • Verify the image runs: docker run --rm ghcr.io/andrewring/github-distributed-owners:<tag> --version

Generated with Devin

andrewring and others added 6 commits June 15, 2026 23:53
Adds a docker job that reuses the already-built static Linux binaries
to build and push multi-arch (amd64/arm64) images to GHCR. Uses a
minimal scratch-based Dockerfile with no Rust compilation inside
Docker.

Images are tagged with semver versions (e.g. 0.1.12, 0.1, 0) and
published to ghcr.io/andrewring/github-distributed-owners.

Generated with [Devin](https://cli.devin.ai/docs)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Old tags don't have the Dockerfile, so checking out at the tag ref
fails. Generate it inline in the workflow instead — the repo copy
remains for documentation/discoverability.

Also removes the now-unnecessary contents: read permission from the
docker job.

Generated with [Devin](https://cli.devin.ai/docs)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The docker job generates this inline in the workflow, so the repo
copy is dead code.

Generated with [Devin](https://cli.devin.ai/docs)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Add Swatinem/rust-cache to the build matrix for faster re-runs
  and sequential backfill builds
- Add update_tags input to workflow_dispatch (default: false) to
  control whether floating Docker tags (latest, major, major.minor)
  are updated. Backfill runs now only push the exact version tag.
  The release trigger always updates all tags.

Generated with [Devin](https://cli.devin.ai/docs)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Artifact upload/download strips the execute bit. Use COPY --chmod=755
(supported by BuildKit/buildx) to restore it in the scratch image.

Generated with [Devin](https://cli.devin.ai/docs)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Adds a summary job that logs all workflow parameters (tag, commit,
trigger, actor, clobber, update_tags) to both the Actions log and
the job summary page as a markdown table.

Generated with [Devin](https://cli.devin.ai/docs)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@andrewring
andrewring merged commit ba384c2 into main Jun 16, 2026
13 of 14 checks passed
@andrewring
andrewring deleted the dev/andrewring/docker-release branch June 16, 2026 22:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant