Docker deploy

.github/workflows/docker.yaml

@@ -0,0 +1,40 @@
+on:
+  workflow_call:
+    outputs:
+      docker_image_tags:
+        description: "Docker image tags"
+        value: ${{ jobs.docker-build-and-push.outputs.docker_image_tags }}
+
+name: Publish Docker image
+
+jobs:
+  docker-build-and-push:
+    name: Push Docker image to Docker Hub
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Extract metadata for Docker
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: p0security/braekhus
+          flavor: |
+            latest=auto
+            prefix=v,onlatest=false
+      - name: Build and push Docker image
+        id: docker-build-and-push
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+    outputs:
+      docker_image_tags: ${{ steps.meta.outputs.tags }}

.github/workflows/on-push-main.yaml

@@ -0,0 +1,24 @@
+on:
+  push:
+    branches: [main]
+  workflow_dispatch: {}
+
+name: Deploy
+
+# By setting the concurrency to a constant string value,
+# only one pipeline can run at the same time.
+# Pipeline from another merge will be in pending state until
+# the current pipeline finishes.
+# If yet another merge happens, the pending pipeline is cancelled.
+# (Only one pipeline is in pending state at any time)
+# See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#concurrency
+concurrency: main-deploy
+
+jobs:
+  test:
+    uses: ./.github/workflows/test.yaml
+
+  docker:
+    uses: ./.github/workflows/docker.yaml
+    secrets: inherit
+

Dockerfile

@@ -5,9 +5,9 @@
 # source: https://github.com/nodejs/docker-node/blob/0adf29a4daa744d828d23a8de4c4397dc43d5761/18/alpine3.17/Dockerfile
 # best practices: https://github.com/nodejs/docker-node/blob/main/docs/BestPractices.md
 
-FROM node:18.15-alpine3.17
+FROM node:18.17-bookworm
 
-WORKDIR ./
+WORKDIR /usr/src/app
 
 # Copy package.json and yarn.lock files
 COPY package.json yarn.lock ./
@@ -19,6 +19,4 @@ RUN yarn install && yarn cache clean
 COPY . ./
 RUN yarn build
 
-# Run with unprivileged `node` user. The `node` user is defined in the base image.
-USER node
 ENTRYPOINT ["yarn"]