feat: build and publish container

Author: gsanchietti

.github/workflows/build-container.yml

@@ -0,0 +1,58 @@
+name: CI - Build and Publish Container
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Determine image tags
+        id: tags
+        run: |
+          SHORT_SHA=${GITHUB_SHA::8}
+          IMAGE=ghcr.io/${GITHUB_REPOSITORY_OWNER}/${GITHUB_REPOSITORY##*/}
+          # Default tag is sha
+          echo "tags=${IMAGE}:sha-${SHORT_SHA}" >> $GITHUB_OUTPUT
+
+          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
+            TAG_NAME=${GITHUB_REF#refs/tags/}
+            echo "tags=${IMAGE}:sha-${SHORT_SHA},${IMAGE}:${TAG_NAME}" >> $GITHUB_OUTPUT
+          elif [[ "$GITHUB_REF" == refs/heads/main ]]; then
+            echo "tags=${IMAGE}:sha-${SHORT_SHA},${IMAGE}:latest" >> $GITHUB_OUTPUT
+          else
+            # sanitize branch name: replace / with - and remove non-alphanum ._- characters
+            BRANCH=${GITHUB_REF#refs/heads/}
+            SAFE_BRANCH=$(echo "$BRANCH" | sed 's#[^A-Za-z0-9._-]#-#g')
+            echo "tags=${IMAGE}:sha-${SHORT_SHA},${IMAGE}:${SAFE_BRANCH}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Build and push
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: Containerfile
+          platforms: linux/amd64
+          push: true
+          tags: ${{ steps.tags.outputs.tags }}

Containerfile

@@ -0,0 +1,20 @@
+# Multi-stage build for matrix2acrobits
+FROM golang:1.24.10-alpine AS builder
+WORKDIR /src
+
+# Cache go mod
+COPY go.mod go.sum ./
+RUN go env -w GOPROXY=https://proxy.golang.org && go mod download
+
+# Copy source and build
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -ldflags='-s -w' -o /out/matrix2acrobits ./main.go
+
+FROM gcr.io/distroless/static:nonroot
+COPY --from=builder /out/matrix2acrobits /usr/local/bin/matrix2acrobits
+
+EXPOSE 8080
+
+USER nonroot:nonroot
+ENTRYPOINT ["/usr/local/bin/matrix2acrobits"]