ci: build and publish an official container image (fix #2)

.github/workflows/build.yml

@@ -7,10 +7,12 @@ on:
     tags:
       - '*'
 
-# Required to publish artifacts, see:
+# contents: write is required to publish artifacts,
+# packages: write is required to push container images.
 # https://goreleaser.com/ci/actions/#token-permissions
 permissions:
   contents: write
+  packages: write
 
 jobs:
   build:
@@ -41,6 +43,13 @@ jobs:
         run: |
           go install github.com/josephspurrier/goversioninfo/cmd/goversioninfo@latest
 
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v4
         with:

.goreleaser.yaml

@@ -27,6 +27,7 @@ builds:
       - -X 'main.commit={{.ShortCommit}}' # set commit information in-program
       - -X 'main.compileTime={{.Date}}' # set timestamp information in-program
       - -X 'main.releaseMode=true' # set gin to releaseMode
+    env: [CGO_ENABLED=0]
     goos: [linux]
     goarch: [amd64]
     goamd64: [v1]
@@ -42,5 +43,23 @@ changelog:
 
 release:
   name_template: "Version {{.Version}}"
+  prerelease: auto
   draft: true
 
+dockers:
+  - use: docker
+    ids: [linux]
+    dockerfile: Dockerfile.goreleaser
+    image_templates:
+      - ghcr.io/jantari/rewinged:latest
+      - ghcr.io/jantari/rewinged:{{.Version}}
+      - "{{ if not .Prerelease }}ghcr.io/jantari/rewinged:stable{{ end }}"
+    build_flag_templates:
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.version={{.Version}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.title=rewinged"
+      - "--label=org.opencontainers.image.description=rewinged is a self-hosted winget package source"
+      - "--label=org.opencontainers.image.url=github.com/jantari/rewinged"
+      - "--label=org.opencontainers.image.source=github.com/jantari/rewinged"
+      - "--label=org.opencontainers.image.licenses=MIT"

Dockerfile

@@ -1,17 +1,28 @@
-# builder image to compile the binary
-FROM golang:1.19.1 as builder
+# syntax=docker/dockerfile:1
+
+# Builder image to compile the binary
+FROM golang:1.19 as builder
 
 WORKDIR $GOPATH/src/rewinged/rewinged/
 COPY . .
 ENV CGO_ENABLED=0
-RUN go build -o /tmp/rewinged
+RUN go build -o /tmp/rewinged -ldflags '-X "main.releaseMode=true"'
 
 
 
-# final image with nothing but the binary
+# Final image with nothing but the binary
 FROM scratch
 
-COPY --from=builder /tmp/rewinged /bin/rewinged
+COPY <<EOF /etc/passwd
+rewinged:x:10002:10002:rewinged:/:/rewinged
+EOF
+
+# WORKDIR creates directories if they don't exist; with 755 and owned by root
+WORKDIR /packages
+WORKDIR /
+
+COPY --from=builder /tmp/rewinged /rewinged
 
-ENTRYPOINT ["/bin/rewinged"]
+USER rewinged
+ENTRYPOINT ["/rewinged"]
 

Dockerfile.goreleaser

@@ -0,0 +1,17 @@
+# syntax=docker/dockerfile:1
+
+FROM scratch
+
+COPY <<EOF /etc/passwd
+rewinged:x:10002:10002:rewinged:/:/rewinged
+EOF
+
+# WORKDIR creates directories if they don't exist; with 755 and owned by root
+WORKDIR /packages
+WORKDIR /
+
+COPY rewinged /rewinged
+
+USER rewinged
+ENTRYPOINT ["/rewinged"]
+