Merge pull request #29 from Aizen93/develop #11

	name: Docker

	# Only runs on tag pushes (e.g. v1.1.0) — not on branch pushes or PRs
	on:
	push:
	tags: ['v*']

	permissions:
	contents: read
	packages: write

	jobs:
	build-server:
	name: Build & Push Server Image
	runs-on: ubuntu-latest

	steps:
	- name: Checkout
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3

	- name: Log in to GitHub Container Registry
	uses: docker/login-action@74a5d142397b4f367a407d7aa6cde2eb4e4aedbb # v3
	with:
	registry: ghcr.io
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Extract metadata
	id: meta
	uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
	with:
	images: ghcr.io/${{ github.repository }}/server
	tags: \|
	type=ref,event=branch
	type=semver,pattern={{version}}
	type=semver,pattern={{major}}.{{minor}}
	type=sha,prefix=

	- name: Build and push
	uses: docker/build-push-action@263435318d21b8e681c14492fe198e362eb58031 # v6
	with:
	context: .
	file: ./Dockerfile
	push: true
	tags: ${{ steps.meta.outputs.tags }}
	labels: ${{ steps.meta.outputs.labels }}
	cache-from: type=gha
	cache-to: type=gha,mode=max

	# IMPORTANT (public repo): After first push, go to GitHub → Packages → server
	# → Package settings → Change visibility to "Private" if you don't want the
	# compiled server image publicly pullable. The image contains NO secrets
	# (all secrets are injected at runtime via env vars), but it does contain
	# your compiled server code + Prisma schema.

Provide feedback