ci: add Docker Hub + GHCR publish workflow on release

.github/dependabot.yml

@@ -0,0 +1,25 @@
+# Dependabot configuration.
+#
+# Goals:
+#   - Stay safe: SHA-pinned third-party Actions get bumped when they
+#     release new versions, so we don't fall behind for years.
+#   - Stay quiet: routine bumps land in ONE grouped PR per month, not
+#     one PR per action per release. (Past experience: ungrouped
+#     SHA-pinning floods the inbox; the grouping config below avoids it.)
+#   - Stay reactive on CVEs: security-advisory PRs ALWAYS fire
+#     immediately regardless of the schedule below. The `interval` only
+#     affects routine version updates, not the security-update path.
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      gha-deps:
+        patterns:
+          - "*"
+    # Use a single label so monthly grouped PRs are easy to filter.
+    labels:
+      - "dependencies"
+      - "github-actions"

.github/workflows/docker-publish.yml

@@ -0,0 +1,103 @@
+name: Publish Docker Image
+
+# Triggers:
+#   - GitHub Release published: builds + pushes the image automatically.
+#     Same trigger as python-publish.yml, so one release ships both
+#     PyPI and Docker artifacts.
+#   - workflow_dispatch: lets a maintainer re-run after a transient
+#     registry failure or a token rotation, without cutting a new release.
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Git ref (tag/branch/SHA) to build from"
+        required: true
+        default: "master"
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write  # required to push to ghcr.io
+    steps:
+      - name: Check out source
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          # On release events the default checkout is the tag.
+          # On workflow_dispatch we honor the user-supplied ref.
+          # All branches/tags/SHAs are repo-controlled, not arbitrary
+          # untrusted text - safe to pass to the checkout action.
+          ref: ${{ github.event.inputs.ref || github.ref }}
+
+      # Multi-arch builds need QEMU for cross-compilation under buildx.
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130  # v3
+
+      # Buildx is the modern docker builder; supports multi-platform output.
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
+
+      # Docker Hub login. Token must be a Hub access token (NOT a password)
+      # scoped to the proxybroker2 repository for least-privilege.
+      - name: Log in to Docker Hub
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      # GHCR login uses the workflow's built-in GITHUB_TOKEN (no extra secret
+      # needed). The `packages: write` permission above is what authorises it.
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # docker/metadata-action computes the tag list from the git ref using
+      # semver rules. Strategy:
+      #   - `:VERSION` (e.g. `:2.0.0b2`) always pushed - exact version pin.
+      #   - `:major`, `:major.minor`, `:latest` ALSO pushed on every release,
+      #     INCLUDING prereleases. Rationale: this project has been in beta
+      #     for over a year. If `:latest` only moved on stable releases,
+      #     users pulling `:latest` would be stuck on a year-old beta until
+      #     2.0.0 ships. A user who pulls `:2` wants the most recent 2.x.y,
+      #     not the most recent stable 2.x.y - same for `:latest`.
+      #   - `:latest` is gated on release events only (not workflow_dispatch)
+      #     so a manual rerun from older code never accidentally advances
+      #     the floating tag.
+      #   - Side-effect: if a future patch is released for an OLDER version
+      #     line (e.g. 1.5.1 after 2.0.0), it would advance `:latest`
+      #     backward. Acceptable for now - this project doesn't maintain
+      #     old version lines. Switch to `flavor: latest=auto` if that
+      #     ever changes.
+      - name: Extract image metadata (tags, labels)
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051  # v5
+        with:
+          images: |
+            bluet/proxybroker2
+            ghcr.io/bluet/proxybroker2
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=raw,value=latest,enable=${{ github.event_name == 'release' }}
+            type=raw,value=manual-{{date 'YYYYMMDDHHmmss'}},enable=${{ github.event_name == 'workflow_dispatch' }}
+
+      # Build once, push to both registries. cache-from/to use the GitHub
+      # Actions cache backend so a second run on the same code reuses
+      # layers and finishes in seconds instead of minutes.
+      - name: Build and push
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25  # v5
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max