build-image-semver.yml

---
name: Build and push semver-tagged Docker image

on:
  push:
    tags:
      - v[0-9]+.[0-9]+.[0-9]+

permissions:
  contents: read # principle of least privilege

jobs:
  build:
    name: Build and push semver-tagged Docker image
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Set up Docker Buildx for multi-platform builds
        uses: docker/setup-buildx-action@v3
        with:
          platforms: ${{ vars.PLATFORMS }}
      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Derive image tag(s)
        uses: docker/metadata-action@v5
        with:
          images: >-
            ${{ secrets.DOCKERHUB_ORGANIZATION_NAME }}/${{ vars.IMAGE_NAME }}
          tags: type=semver,pattern={{version}}
      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          platforms: ${{ vars.PLATFORMS }}
          push: true
          sbom: true
          tags: ${{ env.DOCKER_METADATA_OUTPUT_TAGS }}