name: Docker

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Set up QEMU
        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

      # Production hardening: add dependency and image scanning before publishing,
      # for example cargo-audit plus a container scanner such as Sysdig or Trivy.
      - name: Build multi-arch image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: false
          build-args: |
            GIT_SHA=${{ github.sha }}
          cache-from: type=gha,scope=docker-multiarch
          cache-to: type=gha,mode=max,scope=docker-multiarch