feat: add support for arm64 (#142)

- set explicit action permissions
- make package owner dynamic so forks can test workflow
- build multi platform images using cross compilation amd64 -> arm64
- add a scope to buildx gha cache

.github/workflows/docker.yaml

@@ -20,47 +20,52 @@ on:
       - "Dockerfile"
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   base:
     runs-on: ubuntu-latest
-    name: Build base image (amd64)
+    name: Build base image
     steps:
       # Configure build environment
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
 
       # Authenticate with GHCR
       - name: Login to Github Container Registry
-        uses: docker/login-action@v1
+        if: ${{ github.event_name != 'pull_request' }}
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      # Build all projects and cache
-      - name: Build Base Image
-        uses: docker/build-push-action@v3
+      - name: Build base image
+        uses: docker/build-push-action@v4
         with:
           context: .
-          push: true
-          tags: ghcr.io/revoltchat/base:latest
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          push: ${{ github.event_name != 'pull_request' }}
+          platforms: linux/amd64,linux/arm64
+          tags: ghcr.io/${{ github.repository_owner }}/base:latest
+          cache-from: type=gha,scope=buildx-base-multi-arch
+          cache-to: type=gha,scope=buildx-base-multi-arch,mode=max
 
-  publish_amd64:
+  publish:
     needs: [base]
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request'
     strategy:
       matrix:
         project: [delta, bonfire]
-    name: Build ${{ matrix.project }} image (amd64)
+    name: Build ${{ matrix.project }} image
     steps:
       # Configure build environment
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
 
@@ -68,10 +73,11 @@ jobs:
       - name: Login to DockerHub
         uses: docker/login-action@v2
         with:
+          registry: docker.io
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Login to Github Container Registry
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -86,11 +92,11 @@ jobs:
             {
               "delta": {
                 "path": "crates/delta",
-                "tag": "revoltchat/server"
+                "tag": "${{ github.repository_owner }}/server"
               },
               "bonfire": {
                 "path": "crates/bonfire",
-                "tag": "revoltchat/bonfire"
+                "tag": "${{ github.repository_owner }}/bonfire"
               }
             }
           export_to: output
@@ -98,19 +104,21 @@ jobs:
       # Configure metadata
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v3
+        uses: docker/metadata-action@v4
         with:
-          images: ${{ steps.export.outputs.tag }}, ghcr.io/${{ steps.export.outputs.tag }}
+          images: |
+            docker.io/${{ steps.export.outputs.tag }}
+            ghcr.io/${{ steps.export.outputs.tag }}
 
       # Build crate image
       - name: Publish
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           context: .
           push: true
-          platforms: linux/amd64
+          platforms: linux/amd64,linux/arm64
           file: ${{ steps.export.outputs.path }}/Dockerfile
           tags: ${{ steps.meta.outputs.tags }}
+          build-args: |
+            BASE_IMAGE=ghcr.io/${{ github.repository_owner }}/base:latest
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max