Publish multi-arch container image to GHCR

.github/workflows/publish.yml

@@ -0,0 +1,41 @@
+name: Publish image
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha
+      - uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

README.md

@@ -49,7 +49,7 @@ Prereq: a one-time Google Chat app configuration (~15 min) — see
 
 ```bash
 cp .env.example .env       # fill in GOOGLE_CHAT_AUDIENCE, mount your service account key
-docker compose up -d
+docker compose up -d       # pulls ghcr.io/asyncup-dev/asyncup (amd64 + arm64)
 ```
 
 Expose `POST /chat/events` via HTTPS, point the Chat app at it, then in your team space:

docker-compose.yml

@@ -1,6 +1,8 @@
 services:
   asyncup:
-    build: .
+    image: ghcr.io/asyncup-dev/asyncup:latest
+    # To build from source instead, comment out `image:` and uncomment:
+    # build: .
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/guide/deployment.md

@@ -4,12 +4,25 @@ AsyncUp is one small container with SQLite inside — no external database, no
 queue, no other moving parts. Google Chat needs to reach it on a public
 HTTPS URL.
 
+## Prebuilt image
+
+Multi-arch images (`linux/amd64`, `linux/arm64`) are published to GHCR on
+every merge to `main`:
+
+```bash
+docker pull ghcr.io/asyncup-dev/asyncup:latest
+```
+
+Tags: `latest` (main), `vX.Y.Z` + `X.Y` (releases), `sha-…` (every build) —
+pin a digest for reproducible deploys. Building from source stays a
+one-liner (`docker build -t asyncup .`) if you prefer auditing what you run.
+
 ## Docker Compose (simplest)
 
 ```bash
 cp .env.example .env       # set GOOGLE_CHAT_AUDIENCE, credentials path
 # uncomment the service-account.json mount in docker-compose.yml
-docker compose up -d
+docker compose up -d       # pulls the GHCR image by default
 ```
 
 Put it behind any HTTPS reverse proxy (Caddy, nginx, Traefik) and point the