ci: add Docker Hub + GHCR publish workflow on release

.github/dependabot.yml

@@ -0,0 +1,25 @@
+# Dependabot configuration.
+#
+# Goals:
+#   - Stay safe: SHA-pinned third-party Actions get bumped when they
+#     release new versions, so we don't fall behind for years.
+#   - Stay quiet: routine bumps land in ONE grouped PR per month, not
+#     one PR per action per release. (Past experience: ungrouped
+#     SHA-pinning floods the inbox; the grouping config below avoids it.)
+#   - Stay reactive on CVEs: security-advisory PRs ALWAYS fire
+#     immediately regardless of the schedule below. The `interval` only
+#     affects routine version updates, not the security-update path.
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      gha-deps:
+        patterns:
+          - "*"
+    # Use a single label so monthly grouped PRs are easy to filter.
+    labels:
+      - "dependencies"
+      - "github-actions"

.github/workflows/docker-publish.yml

@@ -0,0 +1,114 @@
+name: Publish Docker Image
+
+# Triggers:
+#   - GitHub Release published: builds + pushes the image automatically.
+#     Same trigger as python-publish.yml, so one release ships both
+#     PyPI and Docker artifacts.
+#   - workflow_dispatch: lets a maintainer kick a build of master HEAD,
+#     useful for testing the workflow itself. Does NOT publish version
+#     tags - to (re)publish a specific tagged release, re-fire the
+#     release event by deleting + recreating the GitHub release.
+#     Reason: docker/metadata-action reads GITHUB_REF, which stays at
+#     the workflow's branch (master) for workflow_dispatch even when
+#     checkout uses a different ref. So the version-tag generation
+#     wouldn't fire correctly from a manual ref input.
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write  # required to push to ghcr.io
+    steps:
+      - name: Check out source
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        # ref omitted: uses GITHUB_REF, which is the released tag for
+        # release events and master for workflow_dispatch.
+
+      # Multi-arch builds need QEMU for cross-compilation under buildx.
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130  # v3
+
+      # Buildx is the modern docker builder; supports multi-platform output.
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
+
+      # Docker Hub login. Token must be a Hub access token (NOT a password)
+      # scoped to the proxybroker2 repository for least-privilege.
+      - name: Log in to Docker Hub
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      # GHCR login uses the workflow's built-in GITHUB_TOKEN (no extra secret
+      # needed). The `packages: write` permission above is what authorises it.
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Tag strategy:
+      #
+      # `:VERSION` (e.g. `:2.0.0b2`) - exact version pin, always pushed.
+      #     Uses type=pep440, NOT type=semver: this project versions in
+      #     PEP 440 form (`2.0.0b2`), not SemVer (`2.0.0-beta.2`).
+      #     `type=semver,pattern={{version}}` would silently fail to match
+      #     PEP 440 prerelease tags and skip the build.
+      #
+      # `:major.minor` (e.g. `:2.0`) and `:major` (e.g. `:2`) - floating
+      #     aliases, advanced on EVERY release including prereleases.
+      #     We use `type=match` with a regex against the git tag name,
+      #     NOT `type=pep440,pattern={{major}}.{{minor}}`, because
+      #     metadata-action's PEP 440/SemVer parsers deliberately hold
+      #     these floating aliases back for prereleases. We want them to
+      #     advance for prereleases too: this project has been in beta
+      #     for over a year, and locking floating tags to stable releases
+      #     would leave them frozen on `v2.0.0b1` (May 2025) until 2.0.0
+      #     ships. A user pulling `:2` wants the latest 2.x.y, not the
+      #     latest stable 2.x.y.
+      #
+      # `:latest` - same advancement policy as :major / :major.minor.
+      #     Gated on `release` events only (not workflow_dispatch) so a
+      #     manual master-HEAD build never accidentally moves :latest.
+      #
+      # `:manual-<timestamp>` - per-build tag for workflow_dispatch.
+      #     Avoids collision with release-published tags.
+      #
+      # Acknowledged side-effect: if a future patch is released for an
+      # OLDER version line (e.g. 1.5.1 after 2.0.0), :latest / :major /
+      # :major.minor would advance backward. Not maintaining old version
+      # lines today; switch to `flavor: latest=auto` if that changes.
+      - name: Extract image metadata (tags, labels)
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051  # v5
+        with:
+          images: |
+            bluet/proxybroker2
+            ghcr.io/bluet/proxybroker2
+          tags: |
+            type=pep440,pattern={{version}}
+            type=match,pattern=v(\d+\.\d+),group=1,enable=${{ github.event_name == 'release' }}
+            type=match,pattern=v(\d+),group=1,enable=${{ github.event_name == 'release' }}
+            type=raw,value=latest,enable=${{ github.event_name == 'release' }}
+            type=raw,value=manual-{{date 'YYYYMMDDHHmmss'}},enable=${{ github.event_name == 'workflow_dispatch' }}
+
+      # Build once, push to both registries. cache-from/to use the GitHub
+      # Actions cache backend so a second run on the same code reuses
+      # layers and finishes in seconds instead of minutes.
+      - name: Build and push
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25  # v5
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max