ci: switch image publishing target to Docker Hub with graceful secret gating

Author: Thomas Tupper

.github/workflows/publish-image.yml

@@ -1,25 +1,56 @@
 name: publish-image
+
 on:
   push:
     branches: [main]
   workflow_dispatch:
+
 permissions:
   contents: read
-  packages: write
+
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Log in to GHCR
+
+      - name: Set image metadata
+        id: meta
+        run: |
+          echo "image=docker.io/foxlightfoundation/foxmemory-deploy" >> "$GITHUB_OUTPUT"
+          echo "sha_tag=${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
+
+      - name: Check Docker Hub secrets
+        id: secrets
+        env:
+          DH_USER: ${{ secrets.foxlightfoundation }}
+          DH_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+        run: |
+          if [ -n "$DH_USER" ] && [ -n "$DH_TOKEN" ]; then
+            echo "ready=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "ready=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Log in to Docker Hub
+        if: steps.secrets.outputs.ready == 'true'
         uses: docker/login-action@v3
         with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
+          username: ${{ secrets.foxlightfoundation }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push (Docker Hub)
+        if: steps.secrets.outputs.ready == 'true'
         uses: docker/build-push-action@v6
         with:
           context: .
           push: true
-          tags: ghcr.io/foxlight-foundation/foxmemory-deploy:latest
+          tags: |
+            ${{ steps.meta.outputs.image }}:latest
+            ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.sha_tag }}
+
+      - name: Skip publish (missing secrets)
+        if: steps.secrets.outputs.ready != 'true'
+        run: |
+          echo "Docker Hub secrets are not configured."
+          echo "Set foxlightfoundation and DOCKERHUB_TOKEN in repo secrets to enable publish."