Overhaul CI, Docker, and release workflows

.github/workflows/docker.yml

@@ -1,10 +1,12 @@
-name: Docker Build & Push
+name: Docker
 
 on:
   push:
     branches:
-      - master
       - main
+      - master
+    tags:
+      - 'v*'
     paths:
       - 'VERSION'
       - 'Dockerfile'
@@ -12,52 +14,49 @@ on:
       - 'web/**'
       - 'Cargo.toml'
       - 'Cargo.lock'
+      - 'migrations/**'
+      - 'build.rs'
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   REGISTRY: ghcr.io
-  # Must be lowercase for Docker registry
   IMAGE_NAME: ${{ github.repository }}
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   docker:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
 
       - name: Read VERSION file
         id: version
-        run: echo "version=$(cat VERSION | tr -d '\n\r')" >> $GITHUB_OUTPUT
+        run: echo "version=$(tr -d '\n\r' < VERSION)" >> "$GITHUB_OUTPUT"
 
       - name: Lowercase image name
         id: image
-        run: echo "name=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
+        run: echo "name=$(echo '${{ env.REGISTRY }}/${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
 
-      - name: Compute release lane
-        id: release_lane
-        shell: bash
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          IMAGE="${{ env.REGISTRY }}/${{ steps.image.outputs.name }}"
-          if [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            {
-              echo "tags<<EOF"
-              echo "${IMAGE}:${VERSION}"
-              echo "${IMAGE}:latest"
-              echo "EOF"
-            } >> "$GITHUB_OUTPUT"
-          else
-            {
-              echo "tags<<EOF"
-              echo "${IMAGE}:${VERSION}"
-              echo "EOF"
-            } >> "$GITHUB_OUTPUT"
-          fi
+      - name: Compute tags
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ steps.image.outputs.name }}
+          tags: |
+            type=raw,value=${{ steps.version.outputs.version }}
+            type=raw,value=latest,enable=${{ !contains(steps.version.outputs.version, '-') }}
+            type=raw,value=edge,enable=${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master' }}
+            type=sha,prefix=sha-,format=short
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -65,7 +64,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Log in to the Container registry
+      - name: Log in to GHCR
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -73,14 +72,26 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        id: build
+        uses: docker/build-push-action@v6
         with:
           context: .
-          platforms: linux/amd64
+          platforms: linux/amd64,linux/arm64
           push: true
-          tags: ${{ steps.release_lane.outputs.tags }}
-          labels: |
-            org.opencontainers.image.version=${{ steps.version.outputs.version }}
-            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          provenance: false
+
+      - name: Write job summary
+        shell: bash
+        run: |
+          set -euo pipefail
+          {
+            echo "### Docker Build"
+            echo "**Image:** ${{ steps.image.outputs.name }}"
+            echo "**Version:** ${{ steps.version.outputs.version }}"
+            echo "**Platforms:** linux/amd64, linux/arm64"
+            echo "**Digest:** ${{ steps.build.outputs.digest }}"
+          } >> "$GITHUB_STEP_SUMMARY"