Add workflows for building and pushing Docker image

.github/CODEOWNERS

@@ -1 +1 @@
-* @bgrnwd @tyler-richardett @mattyanselmo @rvino
+* @American-Soccer-Analysis/contributors

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      actions:
+        patterns:
+          - "*"

.github/workflows/docker-ci.yml

@@ -0,0 +1,28 @@
+name: Build Docker Image 🐋
+on:
+  push:
+    branches:
+      - '**'
+      - main
+    paths:
+      - Dockerfile
+  workflow_dispatch:
+jobs:
+  docker-build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build
+        uses: docker/build-push-action@v6
+        with:
+          push: false
+          file: ./Dockerfile
+          context: .

.github/workflows/docker.yml

@@ -0,0 +1,43 @@
+name: Publish Docker Image 🐋
+on:
+  release:
+    types: [published]
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
+      attestations: write
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push
+        id: push
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: .
+          file: ./Dockerfile
+          tags: americansocceranalysis/app:latest, americansocceranalysis/app:${{ github.event.release.tag_name }}
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-name: index.docker.io/american-soccer-analysis/app
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

Dockerfile

@@ -2,6 +2,7 @@
 # Match R version in renv.lock
 FROM rocker/r-ver:4.5.2 AS deps
 WORKDIR /code
+# Install system dependencies
 RUN apt-get update -qq && apt-get -y --no-install-recommends install \
     libxml2-dev \
     libcairo2-dev \
@@ -20,6 +21,7 @@ RUN apt-get update -qq && apt-get -y --no-install-recommends install \
     default-jdk \
     cmake
 
+# Update all system packages
 RUN apt-get update && \
     apt-get upgrade -y && \
     apt-get clean