From a6bb8791fe906bb8e2eebab7f1d05f83312fc1cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Dupressoir?= <fdupress@gmail.com>
Date: Fri, 28 Nov 2025 16:39:57 +0000
Subject: [PATCH] prepare for docker builds in CI

---
 .github/workflows/docker.yml   | 26 ++++++++++++++++++++++++++
 scripts/docker/Dockerfile.base |  4 ++--
 scripts/docker/Dockerfile.test |  2 +-
 scripts/docker/Makefile        |  7 ++++---
 4 files changed, 33 insertions(+), 6 deletions(-)
 create mode 100644 .github/workflows/docker.yml

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 0000000000..09d1fdc0ea
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,26 @@
+name: EasyCrypt Docker Containers Build and Publish
+
+on:
+  push:
+    branches:
+      - 'main'
+      - 'latest'
+    tags:
+      - 'r[0-9]+.[0-9]+'
+  workflow_dispatch:
+
+jobs:
+  make-image:
+    name: Make and Publish Container Images
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: true
+      matrix:
+        target: [base, build, test]
+    steps:
+    - uses: actions/checkout@v4
+    - name: Install docker and docker-buildx
+      run: apt install docker docker-buildx
+    - name: Build ${{ matrix.target }} Image
+      run: TAG=${{ github.ref_name }} VARIANT=${{ matrix.target }} make -C scripts/docker publish
+
diff --git a/scripts/docker/Dockerfile.base b/scripts/docker/Dockerfile.base
index b8aff9ce11..1a43903b01 100644
--- a/scripts/docker/Dockerfile.base
+++ b/scripts/docker/Dockerfile.base
@@ -2,11 +2,11 @@
 
 FROM debian:stable
 
-MAINTAINER Pierre-Yves Strub <pierre-yves@strub.nu>
+LABEL org.opencontainers.image.maintainer="Pierre-Yves Strub <pierre-yves@strub.nu>"
 
 ARG user=charlie
 
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 
 RUN \
 	apt-get -q -y update && \
diff --git a/scripts/docker/Dockerfile.test b/scripts/docker/Dockerfile.test
index f8dcd165da..89c73ca911 100644
--- a/scripts/docker/Dockerfile.test
+++ b/scripts/docker/Dockerfile.test
@@ -5,7 +5,7 @@ FROM ./Dockerfile.build
 ARG EC_VERSION=main
 
 RUN \
-	opam pin --dev-repo \
+	opam pin \
 	add -n easycrypt https://github.com/EasyCrypt/easycrypt.git#${EC_VERSION} && \
 	opam install -v easycrypt && \
 	rm -rf .opam/packages.dev/*
diff --git a/scripts/docker/Makefile b/scripts/docker/Makefile
index f8551c2f94..12258340a1 100644
--- a/scripts/docker/Makefile
+++ b/scripts/docker/Makefile
@@ -2,6 +2,7 @@
 
 # --------------------------------------------------------------------
 VARIANT ?= build
+TAG     ?= main
 
 # --------------------------------------------------------------------
 .PHONY: default build publish
@@ -10,9 +11,9 @@ default: build
 
 build:
 	docker build -f Dockerfile.$(VARIANT) \
-	  --platform linux/amd64 \
-	  -t ghcr.io/easycrypt/ec-$(VARIANT)-box \
+    --platform linux/amd64 \
+    -t ghcr.io/easycrypt/ec-$(VARIANT)-box:$(TAG) \
 	  .
 
 publish:
-	docker push ghcr.io/easycrypt/ec-$(VARIANT)-box
+	docker push ghcr.io/easycrypt/ec-$(VARIANT)-box:$(TAG)