From 0796b3a99041db25df6aa66a9a374cbce80d8309 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=94=B0=E8=88=8E=E3=81=AE=E3=83=8D=E3=82=BA=E3=83=9F?=
 <chunchi.che@lexmount.com>
Date: Tue, 25 Aug 2026 15:44:02 +0800
Subject: [PATCH] ci: publish backend images to Docker Hub

Detailed changes:

- Publish AMD64 SHA, latest, and release images after all CI checks pass

- Attach SBOM and provenance, and update Docker and Kubernetes documentation

Signed-off-by: chunchi.che@lexmount.com

Co-Authored-By: GPT-5 Codex <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 70 ++++++++++++++++++++++++++++++++++++++++
 README.md                | 11 +++++++
 k8s/deployment.yaml      |  2 +-
 3 files changed, 82 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2cf2a1a..e386f5d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,8 @@ on:
   push:
     branches:
       - main
+    tags:
+      - "v*"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -80,3 +82,71 @@ jobs:
 
       - name: Render Kubernetes manifests
         run: kubectl kustomize k8s > /tmp/abyss-backend.yaml
+
+  publish:
+    name: Publish Docker Hub image
+    if: github.event_name == 'push'
+    needs:
+      - rust
+      - blackbox
+      - packaging
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Generate image metadata
+        id: metadata
+        uses: docker/metadata-action@v6
+        with:
+          images: lexmount/abyss-backend
+          flavor: latest=false
+          tags: |
+            type=sha,prefix=sha-,format=long
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+          labels: |
+            org.opencontainers.image.title=abyss-backend
+            org.opencontainers.image.description=Open-source, self-hostable Agent event store for Abyss
+            org.opencontainers.image.licenses=GPL-3.0-only
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: lexmount
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and publish image
+        id: image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/amd64
+          push: true
+          tags: ${{ steps.metadata.outputs.tags }}
+          labels: ${{ steps.metadata.outputs.labels }}
+          annotations: ${{ steps.metadata.outputs.annotations }}
+          provenance: mode=max
+          sbom: true
+
+      - name: Record published image
+        env:
+          IMAGE_DIGEST: ${{ steps.image.outputs.digest }}
+          IMAGE_TAGS: ${{ steps.metadata.outputs.tags }}
+        run: |
+          {
+            echo "## Published Docker image"
+            echo
+            echo "Digest: \`lexmount/abyss-backend@${IMAGE_DIGEST}\`"
+            echo
+            echo "Tags:"
+            while IFS= read -r image_tag; do
+              echo "- \`${image_tag}\`"
+            done <<< "${IMAGE_TAGS}"
+          } >> "${GITHUB_STEP_SUMMARY}"
diff --git a/README.md b/README.md
index 867b5ba..286f1dc 100644
--- a/README.md
+++ b/README.md
@@ -104,6 +104,17 @@ work.
 
 ### Docker
 
+Successful `main` builds publish the public
+`docker.io/lexmount/abyss-backend` image. Every build receives an immutable
+`sha-<full-git-sha>` tag, while the newest successful `main` build also receives
+`latest`. Version tags such as `v1.2.3` additionally publish `v1.2.3`, `1.2.3`,
+`1.2`, and `1` tags. Automated deployments should pin the published digest
+instead of a mutable tag:
+
+```bash
+docker pull 'lexmount/abyss-backend@sha256:<digest>'
+```
+
 The following example starts PostgreSQL and `abyss-backend` on a private Docker
 network. PostgreSQL data is retained in a named volume, while Elasticsearch
 remains disabled.
diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index 0ab828a..d594152 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -21,7 +21,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: abyss-backend
-          image: ghcr.io/lexmount/abyss-backend:latest
+          image: docker.io/lexmount/abyss-backend:latest
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false