ci: add publish.yml workflow

.github/workflows/publish.yml

@@ -0,0 +1,56 @@
+name: Publish Docker image
+
+on:
+    release:
+        types: [ published ]
+
+jobs:
+    push_to_registries:
+        name: Push Docker image to multiple registries
+        runs-on: ubuntu-latest
+        permissions:
+            packages: write
+            contents: read
+            attestations: write
+            id-token: write
+        steps:
+            -   name: Check out the repo
+                uses: actions/checkout@v4
+
+            -   name: Log in to Docker Hub
+                uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
+                with:
+                    username: ${{ secrets.DOCKER_USERNAME }}
+                    password: ${{ secrets.DOCKER_PASSWORD }}
+
+            -   name: Log in to the Container registry
+                uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+                with:
+                    registry: ghcr.io
+                    username: ${{ github.actor }}
+                    password: ${{ secrets.GITHUB_TOKEN }}
+
+            -   name: Extract metadata (tags, labels) for Docker
+                id: meta
+                uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+                with:
+                    images: |
+                        maelgangloff/domain-watchdog
+                        ghcr.io/${{ github.repository }}
+
+            -   name: Build and push Docker images
+                id: push
+                uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
+                with:
+                    context: .
+                    target: frankenphp_prod
+                    push: true
+                    tags: ${{ steps.meta.outputs.tags }}
+                    labels: ${{ steps.meta.outputs.labels }}
+
+            -   name: Generate artifact attestation
+                uses: actions/attest-build-provenance@v1
+                with:
+                    subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
+                    subject-digest: ${{ steps.push.outputs.digest }}
+                    push-to-registry: true