ci: configure docker publish to ghcr

[Atharva0506]

Addressed Issues:

Feature: GHCR Docker Publish

Screenshots/Recordings:

N/A

Additional Notes:

• Added dynamically downcased IMAGE_NAME step to prevent docker pull / docker push errors on GHCR since repository names must be fully lowercase.
• Added --cache-from=type=gha to the PR verification script to speed up builds by reusing the layers created by docker/build-push-action.

Checklist

• My code follows the project's code style and conventions
• I have made corresponding changes to the documentation
• My changes generate no new warnings or errors
• I have joined the Discord server and I will share a link to this PR with the project maintainers there
• I have read the Contributing Guidelines

⚠️ AI Notice - Important!

We encourage contributors to use AI tools responsibly when creating Pull Requests. While AI can be a valuable aid, it is essential to ensure that your contributions meet the task requirements, build successfully, include relevant tests, and pass all linters. Submissions that do not meet these standards may be closed without warning to maintain the quality and integrity of the project. Please take the time to understand the changes you are proposing and their impact.

Summary by CodeRabbit

• New Features
  • Added automated multi-platform container image builds and publishing.
  • Added image security metadata, including provenance and SBOM generation.
  • Added automated container health checks before release completion.
• Improvements
  • Expanded container build exclusions to reduce build-context size and noise.
  • Added standardized OCI image metadata labels for better registry display.
  • Streamlined CI workflow behavior for faster security analysis and Go-based releases.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 535fed8e-7eda-4e65-b914-57dc5271f415

📥 Commits

Reviewing files that changed from the base of the PR and between 11fa665 and abea1a4.

📒 Files selected for processing (2)

• .github/workflows/docker-publish.yml
• Dockerfile

---

Walkthrough

Docker build inputs and OCI metadata were updated. A GitHub Actions workflow now builds, publishes, attests, and health-checks multi-architecture images. CodeQL and Go release workflow setup steps were also revised.

Changes

Container Delivery

Layer / File(s)	Summary
Image context and metadata .dockerignore, Dockerfile	Docker build exclusions were expanded, and OCI image source, description, license, title, and vendor labels were added.
Multi-architecture image publishing .github/workflows/docker-publish.yml	Added GHCR publishing, Buildx builds, caching, provenance, SBOM generation, and attestations for main-branch and semver-tag events.
Pull request and release smoke tests .github/workflows/docker-publish.yml	PR and release paths run containers, poll /health, validate "status":"ok", and clean up containers.

CI Toolchain Configuration

Layer / File(s)	Summary
Static analysis and release setup .github/workflows/codeql.yml, .github/workflows/release-goreleaser.yml	Removed CodeQL language runtime setup steps and configured Go setup from go.mod with caching disabled.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions as GitHub Actions
  participant Buildx
  participant GHCR
  participant Container as Docker container
  GitHubActions->>Buildx: Build multi-platform image
  Buildx->>GHCR: Push image and artifacts
  GitHubActions->>GHCR: Create digest attestation
  GitHubActions->>GHCR: Pull image by digest
  GitHubActions->>Container: Run image and poll /health

Loading

Possibly related PRs

• AOSSIE-Org/ThruBox-Server#9: Updates .dockerignore with overlapping Docker build-context exclusions.
• AOSSIE-Org/ThruBox-Server#17: Contains overlapping CodeQL and Go release workflow changes.

Poem

A bunny packs the Docker crate,
With labels neat and builds first-rate.
GHCR gets images bright,
Health checks hop through day and night.
CI finds its Go-sized way!

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding CI configuration to build and publish Docker images to GHCR.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

	Messages
📖	⚠️ PR Template Check These are non-blocking, but please fix: No issue linked. Consider adding Fixes #<number> (e.g. Fixes #42) under the Addressed Issues section. Some required checklist items are not completed: My PR addresses a single issue

Generated by 🚫 dangerJS against abea1a4

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/docker-publish.yml:
- Line 47: Update every referenced GitHub Action in the docker-publish
workflow—including checkout, QEMU, Buildx, login, metadata, build-push, and
attest-build-provenance—to use the exact verified commit SHA corresponding to
its current version tag. Preserve each action’s existing version and
configuration while replacing only the mutable tag references, and confirm all
seven SHAs before merging.
- Around line 46-47: Update the actions/checkout step in the Docker publish
workflow to set persist-credentials to false, ensuring checkout credentials are
not retained for subsequent steps.
- Around line 70-96: Add explicit metadata-action tag rules in the “Extract
Docker metadata” step for the intended main and latest tags, or revise the
surrounding comments to describe the actual output from type=edge,branch=main.
Keep the existing semver and SHA rules unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: fd77ee1d-253e-4d3c-89e8-85636d08ba2a

📥 Commits

Reviewing files that changed from the base of the PR and between 06f4f26 and 11fa665.

📒 Files selected for processing (5)

• .dockerignore
• .github/workflows/codeql.yml
• .github/workflows/docker-publish.yml
• .github/workflows/release-goreleaser.yml
• Dockerfile

💤 Files with no reviewable changes (1)

• .github/workflows/codeql.yml