github: Build and publish Docker image on release

[bep]

Fixes #10760

[bep]

@morremeyer a question;

• The build above gets a 403 error (see below) ...
• The GITHUB_TOKEN needed for this; the token that gets "auto injected" is not good enough for this?
• Reading this, it says I need to create a "personal token" (https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication); is that your experience with this as well?

Error: buildx failed with: ERROR: failed to solve: failed to push ghcr.io/gohugoio/hugo: failed to authorize: failed to fetch anonymous token: unexpected status from GET request to https://ghcr.io/token?scope=repository%3Agohugoio%2Fhugo%3Apull%2Cpush&service=ghcr.io: 403 Forbidden

[morremeyer]

@bep The GITHUB_TOKEN that gets injected is enough, since the packages:write permission is set in https://github.com/gohugoio/hugo/pull/12734/files#diff-113df80dfdb383808d66c98190c3f60ea45745427f926da3b04f572ff081d8a6R13-R14.

I use it in the same way in https://github.com/community-tooling/oci-images/blob/5b78318d705c60ff3fd66dca827041f98ee18c7a/.github/workflows/build.yml.

What I forgot in this PR is to remove the if condition to log in only on tags, which should not be set here.

With the suggestions, this will now build and push for branches & PRs as defined in https://github.com/docker/metadata-action#typeref:

• For a branch, the image tag will be the branch name
• For a tag, the image tag will be the tag name

If you want, I can go through the different scenarios on my fork to verify them.

[bep]

If you want, I can go through the different scenarios on my fork to verify them.

No, that's fine. I need to understand this setup myself, and a little trying-and-failing helps ...

[morremeyer]

Feel free to ping me for anything related to the image in the future, too - I'll use the image myself, so this will be a nice way to contribute back.

[bep]

@morremeyer I had to add this commit to make the build green: 4b516c3 ... makes sense to you?

I'm doing a Hugo release on either Monday or Tuesday, in which we'll see if the publishing part works ...

[morremeyer]

That works, but we might end up with layers/images that are never published, since we build on push of changes to the Dockerfile or the workflow and then never merge these images, if it's not a tag.

My suggestion in #12734 (comment) should fix that while still merging for all relevant events.

I also realized that we need to run for tags, not only for pushes, so I opened a second suggestion for that with #12734 (comment).

[bep]

I also realized that we need to run for tags, not only for pushes,

Good catch, added ...