.forgejo/workflows/docker.yml

@@ -1,7 +1,15 @@
+# Based on https://github.com/docker/build-push-action
+
+name: "Docker"
+
 on:
-  push:
-    tags:
-      - 'v*'
+  release: # A GitHub release was published
+    types: [published]
+  workflow_dispatch: # A build was manually requested
+  workflow_call: # Another pipeline called us
+    secrets:
+      DOCKER_TOKEN:
+        required: true
 
 env:
   GHCR_NAMESPACE: sigb.us
@@ -12,11 +20,11 @@ jobs:
   monolith:
     name: Monolith image
     runs-on: docker
-    container:
-      image: ghcr.io/catthehacker/ubuntu:act-latest
+    image: ubuntu:latest
     permissions:
       contents: read
       packages: write
+      security-events: write # To upload Trivy sarif files
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -24,6 +32,8 @@ jobs:
         if: github.event_name == 'release' # Only for GitHub releases
         run: |
           echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Login to sigb.us container registry
@@ -34,9 +44,12 @@ jobs:
           password: ${{ secrets.FORGEJO_TOKEN }}
 
       - name: Build main monolith image
+        if: github.ref_name == 'main'
         id: docker_build_monolith
         uses: docker/build-push-action@v3
         with:
+          cache-from: type=registry,ref=git.sigb.us/${{ env.GHCR_NAMESPACE }}/dendrite-monolith:buildcache
+          cache-to: type=registry,ref=git.sigb.us/${{ env.GHCR_NAMESPACE }}/dendrite-monolith:buildcache,mode=max
           context: .
           platforms: ${{ env.PLATFORMS }}
           push: true
@@ -50,10 +63,12 @@ jobs:
         id: docker_build_monolith_release
         uses: docker/build-push-action@v3
         with:
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           context: .
           platforms: ${{ env.PLATFORMS }}
           push: true
           tags: |
-            git.sigb.us/${{ env.GHCR_NAMESPACE }}/dendrite:latest
-            git.sigb.us/${{ env.GHCR_NAMESPACE }}/dendrite:stable
-            git.sigb.us/${{ env.GHCR_NAMESPACE }}/dendrite:${{ env.RELEASE_VERSION }}
+            git.sigb.us/${{ env.GHCR_NAMESPACE }}/dendrite-monolith:latest
+            git.sigb.us/${{ env.GHCR_NAMESPACE }}/dendrite-monolith:stable
+            git.sigb.us/${{ env.GHCR_NAMESPACE }}/dendrite-monolith:${{ env.RELEASE_VERSION }}