Add a workflow that republishes Electric Docker image to Docker Hub

Author: alco

.github/workflows/ensure_sync_service_image.yml

@@ -71,7 +71,7 @@ jobs:
         if: ${{ !env.TAG }}
         run: |
           echo "TAG=$(
-            git log -1 --format='%H' -- packages/electric-telemetry/ packages/sync-service/
+            git log -1 --format='%h' -- packages/electric-telemetry/ packages/sync-service/
           )" >> $GITHUB_ENV
 
       - name: Determine ELECTRIC_VERSION to pass as a build-arg to the builder

.github/workflows/sync_service_public_docker_image.yml

@@ -0,0 +1,74 @@
+name: Publish Electric to Docker Hub
+
+on:
+  release:
+    - released
+  push:
+    branches: ['main']
+    paths:
+      - 'packages/electric-telemetry/**'
+      - 'packages/sync-service/**'
+  # TMP for testing
+  pull_request:
+    paths:
+      - 'packages/electric-telemetry/**'
+      - 'packages/sync-service/**'
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  ensure_sync_service_image:
+    uses: ./.github/workflows/ensure_sync_service_image.yml
+
+  build_and_publish_canary_image:
+    if: ${{ github.event_name = 'push' }}
+    needs: [ensure_sync_service_image]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: docker/setup-buildx-action@v3
+
+      # # Login to GHCR so we can read/pull the source image if it's private.
+      # # For public GHCR images, this is optional but harmless.
+      # - name: Log in to GHCR
+      #   uses: docker/login-action@v3
+      #   with:
+      #     registry: ghcr.io
+      #     username: ${{ github.actor }}
+      #     password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Login to Docker Hub (create a token in Docker Hub, store as secret).
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          registry: docker.io
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - export SHORT_COMMIT_SHA=$(git rev-parse --short HEAD)
+      - docker buildx build --platform linux/arm64/v8,linux/amd64 --push
+        --build-context electric-telemetry=../electric-telemetry
+        --build-arg ELECTRIC_VERSION=$${ELECTRIC_VERSION}
+        -t $${ELECTRIC_IMAGE_NAME}:canary
+        -t $${ELECTRIC_CANARY_IMAGE_NAME}:$${SHORT_COMMIT_SHA}
+        -t $${ELECTRIC_CANARY_IMAGE_NAME}:latest
+
+      - name: Publish to electricsql/electric:canary and electricsql/electric-canary
+        run: |
+          set -euo pipefail
+
+          # Source is referenced by digest (immutable)
+          SRC_IMAGE="${{ needs.ensure_sync_service_image.outputs.image }}"
+          SRC_DIGEST="${{ needs.ensure_sync_service_image.outputs.digest }}"
+          SRC_REF="${SRC_IMAGE}@${SRC_DIGEST}"
+
+          TARGETS=(
+            "docker.io/electricsql/electric:canary"
+            "docker.io/electricsql/electric-canary:latest"
+            "docker.io/electricsql/electric-canary:${{ needs.ensure_sync_service_image.outputs.tag }}"
+          )
+
+          for t in "${TARGETS[@]}"; do
+            echo docker buildx imagetools create --tag "$t" "$SRC_REF"
+          done