ci: add ci job for publishing image to ghcr.io (#665)

close #658

Author: korikuzma

.github/workflows/release.yml

@@ -48,3 +48,53 @@ jobs:
           path: dist/
       - name: Publish distribution to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
+
+  build-and-push-image:
+    # https://docs.github.com/en/packages/managing-github-packages-using-github-actions-workflows/publishing-and-installing-a-package-with-github-actions#publishing-a-package-using-an-action
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+
+    env:
+      REGISTRY: ghcr.io
+      IMAGE_NAME: ${{ github.repository_owner }}/variation-normalizer-api
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=latest,enable=${{ !github.event.release.prerelease }}
+            type=semver,pattern={{version}}
+
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

Dockerfile

@@ -3,6 +3,10 @@
 # Health checks service up every 5m.
 FROM python:3.12-slim
 
+LABEL org.opencontainers.image.source=https://github.com/cancervariants/variation-normalization
+LABEL org.opencontainers.image.description="Variation Normalizer API container image"
+LABEL org.opencontainers.image.licenses=MIT
+
 WORKDIR /app
 
 ARG VERSION

README.md

@@ -216,19 +216,4 @@ Note that dev/testing dependencies only need to be updated in `pyproject.toml`.
 ### Creating a new release
 
 1. Version number must be updated manually. It's declared under `project.version` in `pyproject.toml`. Ensure that the version value for the Docker image in `compose.yaml` is similarly updated.
-2. Once a commit with an updated version is merged to the `staging` branch, create a new tag + GitHub release (from the `staging` branch). This triggers the PyPI publishing workflow. Presently, new commits to staging should not be merged to `main`.
-3. Pull down all changes (including the latest git tag) to your local environment:
-
-```shell
-git fetch -a
-```
-
-4. Create a new Docker image on the cancervariants Dockerhub profile:
-
-```shell
-export DOCKERHUB_ORG=cancervariants
-export VERSION=$(git describe --tags --abbrev=0)
-docker build --build-arg VERSION=$VERSION -t $DOCKERHUB_ORG/variation-normalizer-api:$VERSION -t $DOCKERHUB_ORG/variation-normalizer-api:latest .
-docker push $DOCKERHUB_ORG/variation-normalizer-api:$VERSION
-docker push $DOCKERHUB_ORG/variation-normalizer-api:latest
-```
+2. Once a commit with an updated version is merged to the `staging` branch, create a new tag + GitHub release (from the `staging` branch). This triggers the PyPI and GHCR publishing workflows. Presently, new commits to staging should not be merged to `main`.

compose.yaml

@@ -1,6 +1,6 @@
 services:
   api:
-    image: cancervariants/variation-normalizer-api:0.15.5
+    image: ghcr.io/cancervariants/variation-normalizer-api:0.15.5
     environment:
       SEQREPO_ROOT_DIR: /usr/local/share/seqrepo/2024-12-20
       # Dummy AWS credentials, don't need to use real ones