CI: release tags are not publishing versioned Docker images to GHCR

[PraveenHarris]

Summary

Versioned Docker image tags (e.g., 1.5.3, v1.5.3) are not being published to GHCR, even though releases are created via semantic-release.

Current Behavior

• On merge to main:
  • build-docker.yml publishes main and latest images
  • release.yml creates a Git tag (e.g., v1.5.3)
• Docker images for the release tag are not published

Root Cause

• Release tags are created using GITHUB_TOKEN
• GitHub does not trigger workflows from events caused by GITHUB_TOKEN
• As a result, the build workflow does not run for the new tag

Proposed Solution

• Move Docker image publishing into release.yml after semantic-release
• Keep build-docker.yml for main and latest images
• Tag release images with:
  • 1.5.3
  • v1.5.3

Source from GitHub: When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN, with the exception of workflow_dispatch [manually triggered] and repository_dispatch [triggered via API], will not create a new workflow run. (ours is push event)

In the short term, can you please trigger build-docker.yml manually so we have the tag available in GHCR. Thanks!

[PraveenHarris]

Could be a very quick fix @manast 🙏

[PraveenHarris]

One possible fix is to consolidate the current build-docker and release workflows into a single streamlined workflow cc:@manast

# CI/CD workflow to build, version, and push Docker images to GHCR.
# Runs semantic-release first to generate version tags, then builds and pushes
# Docker images with both semantic version tags and `latest`.

name: Build and Release Docker Image

on:
  push:
    branches:
      - main

env:
  IMG_NAME: ghcr.io/taskforcesh/bullmq-proxy
  HUSKY: 0

jobs:
  build-and-release:
    name: Build and Release Docker Image
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      issues: write
      pull-requests: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # Setup Bun
      - uses: oven-sh/setup-bun@v1
      - run: bun install

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20.x

      - name: Release with semantic-release
        id: release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npx semantic-release

      # Build Docker tags depending on ref type
      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMG_NAME }}
          tags: |
            type=ref,event=branch         # main branch commit
            type=ref,event=pr             # pull request
            type=semver,pattern={{version}}   # version tag e.g. 1.5.3
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
          flavor: |
            latest=true

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push Docker image
        id: docker_build
        uses: docker/build-push-action@v5
        with:
          push: true # push to registry
          pull: true # always fetch the latest base images
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Image digest
        run: echo ${{ steps.docker_build.outputs.digest }}