Add github actions to build container

.github/workflows/release.yml

@@ -0,0 +1,48 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - '*'
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  release-docker-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Log into registry
+        uses: docker/login-action@v1
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v3
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/scorecard.yml

@@ -0,0 +1,73 @@
+# # This workflow uses actions that are not certified by GitHub. They are provided
+# # by a third-party and are governed by separate terms of service, privacy
+# # policy, and support documentation.
+
+# name: Scorecard supply-chain security
+# on:
+#   # For Branch-Protection check. Only the default branch is supported. See
+#   # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+#   branch_protection_rule:
+#   # To guarantee Maintained check is occasionally updated. See
+#   # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+#   schedule:
+#     - cron: '16 6 * * 5'
+#   push:
+#     branches: [ "main" ]
+
+# # Declare default permissions as read only.
+# permissions: read-all
+
+# jobs:
+#   analysis:
+#     name: Scorecard analysis
+#     runs-on: ubuntu-latest
+#     permissions:
+#       # Needed to upload the results to code-scanning dashboard.
+#       security-events: write
+#       # Needed to publish results and get a badge (see publish_results below).
+#       id-token: write
+#       # Uncomment the permissions below if installing in a private repository.
+#       # contents: read
+#       # actions: read
+
+#     steps:
+#       - name: "Checkout code"
+#         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+#         with:
+#           persist-credentials: false
+
+#       - name: "Run analysis"
+#         uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+#         with:
+#           results_file: results.sarif
+#           results_format: sarif
+#           # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+#           # - you want to enable the Branch-Protection check on a *public* repository, or
+#           # - you are installing Scorecard on a *private* repository
+#           # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+#           # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+#           # Public repositories:
+#           #   - Publish results to OpenSSF REST API for easy access by consumers
+#           #   - Allows the repository to include the Scorecard badge.
+#           #   - See https://github.com/ossf/scorecard-action#publishing-results.
+#           # For private repositories:
+#           #   - `publish_results` will always be set to `false`, regardless
+#           #     of the value entered here.
+#           publish_results: true
+
+#       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+#       # format to the repository Actions tab.
+#       - name: "Upload artifact"
+#         uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
+#         with:
+#           name: SARIF file
+#           path: results.sarif
+#           retention-days: 5
+
+#       # Upload the results to GitHub's code scanning dashboard (optional).
+#       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+#       - name: "Upload to code-scanning"
+#         uses: github/codeql-action/upload-sarif@v3
+#         with:
+#           sarif_file: results.sarif