ci/ghcr docker build

.github/workflows/docker-ghcr.yml

@@ -0,0 +1,75 @@
+name: Docker GHCR
+
+on:
+  push:
+    branches:
+      - master
+      - "feat/**"
+      - "fix/**"
+      - "ci/**"
+      - "chore/**"
+      - "refactor/**"
+      - "test/**"
+  pull_request:
+    branches:
+      - master
+  release:
+    types:
+      - published
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: docker-ghcr-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  docker:
+    name: Build Docker image
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set image name
+        id: image
+        shell: bash
+        run: echo "name=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to GHCR
+        if: github.event_name == 'release'
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ steps.image.outputs.name }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=ref,event=tag
+            type=raw,value=latest,enable=${{ github.event_name == 'release' }}
+
+      - name: Build and optionally push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64
+          push: ${{ github.event_name == 'release' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

README.md

@@ -60,25 +60,45 @@ go test ./...
 
 The Dockerfile is a production multi-stage build. It builds a static Linux binary with `CGO_ENABLED=0`, which is compatible with the pure-Go `modernc.org/sqlite` driver used by this project. Runtime state is stored in `/app/data`; mount it or you will lose the SQLite database when the container is replaced.
 
+Release images are published to GitHub Container Registry under the `KangVin` GitHub owner when a GitHub Release is published. Docker image references must be lowercase, so use `ghcr.io/kangvin/telerelaybot`. Images are tagged as both `latest` and the release version, for example `ghcr.io/kangvin/telerelaybot:v1.0.0`.
+
 ```bash
-docker build -t telegram-relay-bot .
+IMAGE=ghcr.io/kangvin/telerelaybot:latest
+docker pull "$IMAGE"
+
 docker run -d --name telegram-relay-bot \
   --restart unless-stopped \
   --env-file .env \
   -e DATABASE_PATH=/app/data/bot.db \
   -v telegram-relay-bot-data:/app/data \
-  telegram-relay-bot
+  "$IMAGE"
+```
+
+Using Docker Compose:
+
+```bash
+docker compose up -d
+docker compose logs -f
 ```
 
+The included `compose.yml` uses `ghcr.io/kangvin/telerelaybot:latest` by default, stores runtime state in a named volume, and sets `DATABASE_PATH=/app/data/bot.db` inside the container. To pin a specific release, run `TELE_RELAY_BOT_IMAGE=ghcr.io/kangvin/telerelaybot:v1.0.0 docker compose up -d`.
+
 Using a host directory instead:
 
 ```bash
+IMAGE=ghcr.io/kangvin/telerelaybot:latest
 mkdir -p data
 docker run -d --name telegram-relay-bot \
   --env-file .env \
   -e DATABASE_PATH=/app/data/bot.db \
   -v "$PWD/data:/app/data" \
-  telegram-relay-bot
+  "$IMAGE"
+```
+
+To build the image locally instead of using GHCR:
+
+```bash
+docker build -t telegram-relay-bot .
 ```
 
 ## systemd

compose.yml

@@ -0,0 +1,14 @@
+services:
+  bot:
+    image: ${TELE_RELAY_BOT_IMAGE:-ghcr.io/kangvin/telerelaybot:latest}
+    container_name: telegram-relay-bot
+    restart: unless-stopped
+    env_file:
+      - .env
+    environment:
+      DATABASE_PATH: /app/data/bot.db
+    volumes:
+      - telegram-relay-bot-data:/app/data
+
+volumes:
+  telegram-relay-bot-data: