build.yml

# See https://docs.github.com/en/actions/publishing-packages/publishing-docker-images#publishing-images-to-github-packages
name: Create and publish Docker image

on:
  release:
    types: [ published ]
  workflow_dispatch:
    inputs:
      tag:
        description: Image tag
        required: true

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{github.repository}}

jobs:
  build-and-push-image:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      # Buildx is necessary for gha caching
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9

      - name: Log in to the Container registry
        uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7
        with:
          registry: ${{env.REGISTRY}}
          username: ${{github.actor}}
          password: ${{secrets.GITHUB_TOKEN}}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@b2391d37b4157fa4aa2e118d643f417910ff3242
        with:
          images: ${{env.REGISTRY}}/${{env.IMAGE_NAME}}
          tags: |
            type=pep440,pattern={{version}}

      - name: Build and push Docker image
        uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
        with:
          context: .
          push: true
          tags: ${{steps.meta.outputs.tags}}
          labels: ${{steps.meta.outputs.labels}}
          build-args: |
            "SENTRY_AUTH_TOKEN=${{secrets.SENTRY_AUTH_TOKEN}}"
            "RELEASE=${{github.event.release.tag_name}}"
          cache-from: type=gha
          cache-to: type=gha,mode=max