Add Docker image build

Author: MarekSuchanek

.github/workflows/docker.yml

@@ -0,0 +1,78 @@
+name: Docker
+
+on:
+    push:
+
+jobs:
+    docker-image:
+        name: Build Docker Image
+        runs-on: ubuntu-latest
+
+        env:
+          PUBLIC_IMAGE_PREFIX: 'datastewardshipwizard'
+          DOCKER_IMAGE_NAME: 'replies-importer-plugin'
+          DOCKER_META_CONTEXT: '.'
+          DOCKER_META_FILE: 'Dockerfile'
+          DOCKER_META_PLATFORMS: 'linux/amd64,linux/arm64'
+
+        steps:
+            - name: '[setup] Check out repository'
+              uses: actions/checkout@v6
+
+            - name: '[setup] Set up QEMU'
+              uses: docker/setup-qemu-action@v3
+
+            - name: '[setup] Set up Docker Buildx'
+              id: buildx
+              uses: docker/setup-buildx-action@v3
+
+            - name: '[docker] Docker meta'
+              id: meta-test
+              uses: docker/metadata-action@v5
+              with:
+                images: |
+                  ${{ env.PUBLIC_IMAGE_PREFIX }}/${{ env.DOCKER_IMAGE_NAME }}
+                tags: |
+                  type=sha
+
+            - name: '[docker] Docker build'
+              uses: docker/build-push-action@v6
+              with:
+                context: ${{ env.DOCKER_META_CONTEXT }}
+                file: ${{ env.DOCKER_META_FILE }}
+                platforms: ${{ env.DOCKER_META_PLATFORMS }}
+                push: false
+                tags: ${{ steps.meta-test.outputs.tags }}
+                labels: ${{ steps.meta-test.outputs.labels }}
+
+            - name: '[docker-hub] Docker login'
+              if: github.event_name != 'pull_request' && github.actor != 'dependabot[bot]'
+              uses: docker/login-action@v3
+              with:
+                username: ${{ secrets.DOCKER_HUB_USERNAME }}
+                password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+
+            - name: '[docker-hub] Docker meta'
+              id: meta-public
+              if: github.event_name != 'pull_request' && github.actor != 'dependabot[bot]'
+              uses: docker/metadata-action@v5
+              with:
+                images: |
+                  ${{ env.PUBLIC_IMAGE_PREFIX }}/${{ env.DOCKER_IMAGE_NAME }}
+                tags: |
+                  type=ref,event=branch
+                  type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
+                  type=semver,pattern={{version}}
+                  type=semver,pattern={{major}}.{{minor}}
+                  type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }}
+
+            - name: '[docker-hub] Docker build+push'
+              uses: docker/build-push-action@v6
+              if: github.event_name != 'pull_request' && steps.meta-public.outputs.tags != ''
+              with:
+                context: ${{ env.DOCKER_META_CONTEXT }}
+                file: ${{ env.DOCKER_META_FILE }}
+                platforms: ${{ env.DOCKER_META_PLATFORMS }}
+                push: true
+                tags: ${{ steps.meta-public.outputs.tags }}
+                labels: ${{ steps.meta-public.outputs.labels }}

Dockerfile

@@ -0,0 +1,44 @@
+# ---------- Builder stage ----------
+FROM node:24-alpine AS builder
+
+WORKDIR /app
+
+# Install dependencies
+COPY package.json package-lock.json* ./
+RUN npm install
+
+# Copy source and build
+COPY . .
+RUN npm run build
+
+
+# ---------- Nginx (rootless) stage ----------
+FROM nginx:1-alpine
+
+# Create non-root user and group
+RUN addgroup -S app && adduser -S app -G app
+
+# Remove default nginx static content
+RUN rm -rf /usr/share/nginx/html/*
+
+# Copy build output
+COPY --from=builder /app/dist /usr/share/nginx/html
+
+# Custom nginx config (listening on 8080)
+COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
+
+# Ensure permissions for non-root user
+RUN chown -R nginx:nginx /usr/share/nginx/html \
+ && chmod -R 755 /usr/share/nginx/html \
+ && chown -R nginx:nginx /var/cache/nginx \
+ && chown -R nginx:nginx /var/log/nginx \
+ && chown -R nginx:nginx /etc/nginx/conf.d
+RUN touch /var/run/nginx.pid \
+ &&  chown -R nginx:nginx /var/run/nginx.pid
+
+# Run as non-root
+USER nginx
+
+EXPOSE 8080
+
+CMD ["nginx", "-g", "daemon off;"]