From e0e7001bae785165b3e71a2ada6cae11abeac9f8 Mon Sep 17 00:00:00 2001
From: Daniel Kantor <kd@stacklok.com>
Date: Thu, 13 Nov 2025 13:39:37 +0100
Subject: [PATCH 1/2] ci: set up publishing docker image

---
 .github/workflows/docker-publish.yml | 36 ++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 .github/workflows/docker-publish.yml

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
new file mode 100644
index 00000000..9e579fbf
--- /dev/null
+++ b/.github/workflows/docker-publish.yml
@@ -0,0 +1,36 @@
+name: Docker Build and Push
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["**"]
+  # Uncomment below to only run on tags (releases)
+  # push:
+  #   tags: ["v*"]
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  docker:
+    name: Build and Push Docker Image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          context: .
+          push: true
+          tags: ghcr.io/${{ github.repository }}:latest

From 729bd2b50a73b2692b4780cf64300d86316779e7 Mon Sep 17 00:00:00 2001
From: Daniel Kantor <kd@stacklok.com>
Date: Thu, 13 Nov 2025 14:18:29 +0100
Subject: [PATCH 2/2] push only on tags

---
 .github/workflows/docker-publish.yml | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 9e579fbf..3c130cb3 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -2,12 +2,7 @@ name: Docker Build and Push
 
 on:
   push:
-    branches: ["**"]
-  pull_request:
-    branches: ["**"]
-  # Uncomment below to only run on tags (releases)
-  # push:
-  #   tags: ["v*"]
+    tags: ["v*"]
 
 permissions:
   contents: read
@@ -33,4 +28,6 @@ jobs:
         with:
           context: .
           push: true
-          tags: ghcr.io/${{ github.repository }}:latest
+          tags: |
+            ghcr.io/${{ github.repository }}:latest
+            ghcr.io/${{ github.repository }}:${{ github.ref_name }}