5402: Switch image build pipeline to GHCR

.dockerignore

@@ -2,7 +2,7 @@
 !/.git/config
 
 # Unneeded application files
-/.docker/data/README.md
+/.docker
 /.github
 /docs
 /fixtures
@@ -15,6 +15,22 @@
 /scripts
 /tests
 
+# IDE / editor state
+/.idea
+/.vscode
+
+# Compose / task runner / dev tooling configs (not consumed at runtime)
+/docker-compose*.yml
+/Taskfile.yml
+/playwright.config.ts
+
+# CI / quality-tool configs (not consumed at runtime)
+/phpstan.dist.neon
+/phpunit.xml.dist
+/psalm.xml
+/psalm-baseline.xml
+/rector.php
+
 ###> symfony/framework-bundle ###
 /.env.local
 /.env.local.php

.github/workflows/apispec.yaml

@@ -11,7 +11,7 @@ jobs:
     name: API Specification validation
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 2
 

.github/workflows/build-images.yml

@@ -0,0 +1,113 @@
+---
+name: Build docker images
+
+on:
+  push:
+    branches:
+      - develop
+    tags:
+      - "*"
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Login to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Docker meta (API)
+        id: meta-api
+        uses: docker/metadata-action@v6
+        with:
+          images: ghcr.io/os2display/display-api-service
+          tags: |
+            # develop branch → 'develop'
+            type=ref,event=branch
+            # any tag → tag literal (e.g. '3.0.0', '3.0.0-RC1' for release
+            # candidates cut from release/X.Y.Z)
+            type=ref,event=tag
+            # also emit canonical semver tag for valid semver-shaped tags,
+            # so '3.0.0' and '3.0.0-RC1' both produce a properly-typed entry.
+            type=semver,pattern={{version}}
+          # latest=auto adds ':latest' only for non-prerelease semver tags,
+          # so '3.0.0' updates ':latest' but '3.0.0-RC1' does not.
+          flavor: |
+            latest=auto
+
+      - name: Build and push (API)
+        uses: docker/build-push-action@v7
+        with:
+          context: ./infrastructure/display-api-service/
+          file: ./infrastructure/display-api-service/Dockerfile
+          build-contexts: |
+            repository-root=.
+          # Use the version computed by docker/metadata-action so APP_VERSION
+          # matches the image tag for every trigger ('develop' / '3.0.0' /
+          # '3.0.0-RC1') without bespoke string handling per trigger.
+          build-args: |
+            APP_VERSION=${{ steps.meta-api.outputs.version }}
+            APP_RELEASE_VERSION=${{ steps.meta-api.outputs.version }}
+            APP_RELEASE_TIMESTAMP=${{ github.run_number }}
+          push: true
+          tags: ${{ steps.meta-api.outputs.tags }}
+          labels: ${{ steps.meta-api.outputs.labels }}
+          provenance: mode=max
+          sbom: true
+          platforms: linux/amd64,linux/arm64
+          # mode=max caches builder stages (client_app_builder, api_app_builder),
+          # which is what makes multi-arch builds practical to cache at all.
+          # Scoped per image so API and Nginx caches don't evict each other.
+          cache-from: type=gha,scope=display-api-service
+          cache-to: type=gha,mode=max,scope=display-api-service
+
+      - name: Docker meta (Nginx)
+        id: meta-nginx
+        uses: docker/metadata-action@v6
+        with:
+          images: ghcr.io/os2display/display-api-service-nginx
+          tags: |
+            # develop branch → 'develop'
+            type=ref,event=branch
+            # any tag → tag literal (e.g. '3.0.0', '3.0.0-RC1' for release
+            # candidates cut from release/X.Y.Z)
+            type=ref,event=tag
+            # also emit canonical semver tag for valid semver-shaped tags,
+            # so '3.0.0' and '3.0.0-RC1' both produce a properly-typed entry.
+            type=semver,pattern={{version}}
+          flavor: |
+            latest=auto
+
+      - name: Build and push (Nginx)
+        uses: docker/build-push-action@v7
+        with:
+          context: ./infrastructure/nginx/
+          file: ./infrastructure/nginx/Dockerfile
+          build-contexts: |
+            repository-root=.
+          build-args: |
+            APP_VERSION=${{ steps.meta-nginx.outputs.version }}
+            APP_RELEASE_VERSION=${{ steps.meta-nginx.outputs.version }}
+            APP_RELEASE_TIMESTAMP=${{ github.run_number }}
+          push: true
+          tags: ${{ steps.meta-nginx.outputs.tags }}
+          labels: ${{ steps.meta-nginx.outputs.labels }}
+          provenance: mode=max
+          sbom: true
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha,scope=display-api-service-nginx
+          cache-to: type=gha,mode=max,scope=display-api-service-nginx

.github/workflows/changelog.yaml

@@ -18,7 +18,7 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 2
 

.github/workflows/composer.yaml

@@ -41,7 +41,7 @@ jobs:
     strategy:
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - run: |
           docker network create frontend
           docker compose run --rm phpfpm composer validate --strict
@@ -51,7 +51,7 @@ jobs:
     strategy:
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - run: |
           docker network create frontend
           docker compose run --rm phpfpm composer install

.github/workflows/composer_install.yaml

@@ -11,7 +11,7 @@ jobs:
     name: Composer install in prod mode
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup network
         run: docker network create frontend

.github/workflows/doctrine.yaml

@@ -11,7 +11,7 @@ jobs:
     name: Validate Schema
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup network
         run: docker network create frontend

.github/workflows/github_build_release.yml

@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install Task task runner
-        uses: go-task/setup-task@v1
+        uses: go-task/setup-task@v2
 
       - name: Install, Build, Cleanup
         run: |

.github/workflows/javascript.yaml

@@ -27,7 +27,7 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - run: |
           docker network create frontend

.github/workflows/markdown.yaml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - run: |
           docker network create frontend

.github/workflows/php.yaml

@@ -48,7 +48,7 @@ jobs:
     name: PHP - Check Coding Standards
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - run: |
           docker network create frontend
           docker compose run --rm phpfpm composer install

.github/workflows/phpunit.yaml

@@ -11,7 +11,7 @@ jobs:
     name: PHP Unit tests
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup network
         run: docker network create frontend