.github/templates/.release_notes.md.j2

@@ -3,8 +3,17 @@
 ## Release Notes
 {% include ".changes.j2" %}
 {{ "**Full Changelog**: (%s)" | format(prev_version | compare_url(version)) }}
+
 ## Installation
+
 You can install this version via pip from [PyPI](https://pypi.org/project/python-re3data/{{ version }}/):
+
 ```console
 python -m pip install python-re3data=={{ version }}
 ```
+
+or pull the Docker image from [ghcr.io](https://github.com/afuetterer/python-re3data/pkgs/container/python-re3data):
+
+```console
+docker pull ghcr.io/afuetterer/python-re3data:{{ version }}
+```

.github/workflows/publish.yml

@@ -4,46 +4,47 @@ on:
   release:
     types: [created]
   workflow_dispatch: # run manually from actions tab
-  pull_request:
 
 # Set permissions at the job level.
 permissions: {}
 
 jobs:
-  # build:
-  #   name: Build the package
-  #   # disables this workflow from running in a repository that is not part of the indicated organization/user
-  #   if: github.repository_owner == 'afuetterer'
-  #   runs-on: ubuntu-24.04
-  #   permissions:
-  #     attestations: write
-  #     id-token: write
-  #   steps:
-  #   - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
-  #   - uses: hynek/build-and-inspect-python-package@b4fc3f6ba2b3da04f09659be99e2a29fb6146a61 # v2.6.0
-  #     with:
-  #       attest-build-provenance-github: 'true'
-  # publish:
-  #   # disables this workflow from running in a repository that is not part of the indicated organization/user
-  #   if: github.repository_owner == 'afuetterer'
-  #   runs-on: ubuntu-24.04
-  #   needs: build
-  #   environment: publish
-  #   permissions:
-  #     id-token: write
-  #   steps:
-  #   - name: Download package built by build job
-  #     uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
-  #     with:
-  #       name: Packages
-  #       path: dist
-  #   - name: Publish package to PyPI
-  #     uses: pypa/gh-action-pypi-publish@81e9d935c883d0b210363ab89cf05f3894778450 # v1.8.14
+  build:
+    name: Build the package
+    # disables this workflow from running in a repository that is not part of the indicated organization/user
+    if: github.repository_owner == 'afuetterer'
+    runs-on: ubuntu-24.04
+    permissions:
+      attestations: write
+      id-token: write
+    steps:
+    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+    - uses: hynek/build-and-inspect-python-package@b4fc3f6ba2b3da04f09659be99e2a29fb6146a61 # v2.6.0
+      with:
+        attest-build-provenance-github: 'true'
+  publish:
+    # disables this workflow from running in a repository that is not part of the indicated organization/user
+    if: github.repository_owner == 'afuetterer'
+    runs-on: ubuntu-24.04
+    needs: build
+    environment: publish
+    permissions:
+      id-token: write
+    steps:
+    - name: Download package built by build job
+      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+      with:
+        name: Packages
+        path: dist
+    - name: Publish package to PyPI
+      uses: pypa/gh-action-pypi-publish@81e9d935c883d0b210363ab89cf05f3894778450 # v1.8.14
 
   docker:
+    name: Publish Docker image to ghcr.io
     # disables this workflow from running in a repository that is not part of the indicated organization/user
     if: github.repository_owner == 'afuetterer'
     runs-on: ubuntu-24.04
+    needs: build
     permissions:
       contents: read
       packages: write
@@ -59,16 +60,23 @@ jobs:
         password: ${{ secrets.GITHUB_TOKEN }}
     - name: Generate Docker image metadata
       id: meta
+      # Ref: https://github.com/docker/metadata-action?tab=readme-ov-file#customizing
       uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
       with:
         images: ghcr.io/${{ env.IMAGE_NAME }}
-        # tags: |
-        #   type=pep440,pattern={{version}}
-        #   type=pep440,pattern={{major}}.{{minor}}
-    - name: Build and push
+        flavor: latest=true
+        tags: |
+          type=pep440,pattern={{version}}
+          type=pep440,pattern={{major}}.{{minor}}
+    - name: Build and push image to registry
+      # Ref: https://github.com/docker/build-push-action?tab=readme-ov-file#customizing
       uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
       with:
         push: true
-        build-args: VERSION=0.4.0 # TODO
+        build-args: VERSION=${{ github.event.release.name }}
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
         tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}
+        # Ref: https://docs.docker.com/build/attestations/slsa-provenance/
+        provenance: false

README.md

@@ -69,6 +69,12 @@ You can install `python-re3data` via pip from [PyPI][pypi-url]:
 python -m pip install python-re3data
 ```
 
+or pull the Docker image from [ghcr.io](https://github.com/afuetterer/python-re3data/pkgs/container/python-re3data):
+
+```console
+docker pull ghcr.io/afuetterer/python-re3data:latest
+```
+
 ## Documentation
 
 The [documentation][docs-url] is made with [Material for MkDocs](https://github.com/squidfunk/mkdocs-material) and is