docker-build.yml

name: Publish Docker Image

on:
  release:
    types: [published]

jobs:
  build-and-push-image:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
      
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Log in to GHCR
      uses: docker/login-action@v2
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GHCR_TOKEN }}

    - name: Extract Docker metadata (tags, labels)
      uses: docker/metadata-action@v4
      with:
          images: ghcr.io/matthewlarner/inception-mqtt

    - name: Build and push Docker image
      id: push
      uses: docker/build-push-action@v5
      with:
        context: .
        push: true
        tags: |
          ghcr.io/matthewlarner/inception-mqtt:latest
          ghcr.io/matthewlarner/inception-mqtt:${{ github.event.release.tag_name }}

    - name: Generate artifact attestation
      uses: actions/attest-build-provenance@v1
      with:
        subject-name: ghcr.io/matthewlarner/inception-mqtt
        subject-digest: ${{ steps.push.outputs.digest }}
        push-to-registry: true