ci: publish backend images to Docker Hub

.github/workflows/ci.yml

@@ -6,6 +6,8 @@ on:
   push:
     branches:
       - main
+    tags:
+      - "v*"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -80,3 +82,71 @@ jobs:
 
       - name: Render Kubernetes manifests
         run: kubectl kustomize k8s > /tmp/abyss-backend.yaml
+
+  publish:
+    name: Publish Docker Hub image
+    if: github.event_name == 'push'
+    needs:
+      - rust
+      - blackbox
+      - packaging
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Generate image metadata
+        id: metadata
+        uses: docker/metadata-action@v6
+        with:
+          images: lexmount/abyss-backend
+          flavor: latest=false
+          tags: |
+            type=sha,prefix=sha-,format=long
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+          labels: |
+            org.opencontainers.image.title=abyss-backend
+            org.opencontainers.image.description=Open-source, self-hostable Agent event store for Abyss
+            org.opencontainers.image.licenses=GPL-3.0-only
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: lexmount
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and publish image
+        id: image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/amd64
+          push: true
+          tags: ${{ steps.metadata.outputs.tags }}
+          labels: ${{ steps.metadata.outputs.labels }}
+          annotations: ${{ steps.metadata.outputs.annotations }}
+          provenance: mode=max
+          sbom: true
+
+      - name: Record published image
+        env:
+          IMAGE_DIGEST: ${{ steps.image.outputs.digest }}
+          IMAGE_TAGS: ${{ steps.metadata.outputs.tags }}
+        run: |
+          {
+            echo "## Published Docker image"
+            echo
+            echo "Digest: \`lexmount/abyss-backend@${IMAGE_DIGEST}\`"
+            echo
+            echo "Tags:"
+            while IFS= read -r image_tag; do
+              echo "- \`${image_tag}\`"
+            done <<< "${IMAGE_TAGS}"
+          } >> "${GITHUB_STEP_SUMMARY}"

README.md

@@ -104,6 +104,17 @@ work.
 
 ### Docker
 
+Successful `main` builds publish the public
+`docker.io/lexmount/abyss-backend` image. Every build receives an immutable
+`sha-<full-git-sha>` tag, while the newest successful `main` build also receives
+`latest`. Version tags such as `v1.2.3` additionally publish `v1.2.3`, `1.2.3`,
+`1.2`, and `1` tags. Automated deployments should pin the published digest
+instead of a mutable tag:
+
+```bash
+docker pull 'lexmount/abyss-backend@sha256:<digest>'
+```
+
 The following example starts PostgreSQL and `abyss-backend` on a private Docker
 network. PostgreSQL data is retained in a named volume, while Elasticsearch
 remains disabled.

k8s/deployment.yaml

@@ -21,7 +21,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: abyss-backend
-          image: ghcr.io/lexmount/abyss-backend:latest
+          image: docker.io/lexmount/abyss-backend:latest
           imagePullPolicy: IfNotPresent
           securityContext:
             allowPrivilegeEscalation: false