Consider publishing to ghcr.io to support dependabot properly detecting new versions.

[ikreymer]

Unfortunately, this won’t fix Dependabot not showing release notes in its PRs (but should be helpful for other tools). After a bunch of testing, it turns out dependabot/dependabot-core#15417. They just don’t document that fact anywhere. :(

I suppose we could also publish mirror images to ghcr.io -- if that helps with Dependabot detecting security issues. Any reason not to? cc: @mistydemeo @emma-sg

Originally posted by @ikreymer in #1067 (comment)

[ikreymer]

Seems like it should even be possible to do it within one action workflow: https://docs.github.com/en/actions/tutorials/publish-packages/publish-docker-images#publishing-images-to-docker-hub-and-github-packages

[mistydemeo]

I don't mind mirroring to ghcr so long as it's not going to cost us anything, but it's pretty unfortunate we have to do that for dependabot!

[Mr0grog]

This would be a nice feature for me, but I’d echo @mistydemeo that it’s probably not worth going out of your way for if it is costly. Having the release notes in Dependabot PRs is a very nice convenience, but not absolutely critical. They aren’t hard to look up. (Worth noting: I have been considering switching some things I maintain to Renovate and it’s possible it behaves better here. If so, that would make this issue moot for me personally.)

Also, just to make sure it’s clear, someone using Dependabot would need to change their dockerfiles to depend on ghcr.io/webrecorder/browsertrix-crawler to take advantage of this, so it would probably need some docs changes (Dependabot only cares where the image is being pulled from; it isn’t able to see an update for webrecoder/browsertrix-crawler and realize that it is the same as ghcr.io/webrecorder/browsertrix-crawler and then look up the release notes there).