feat: add the GitHub action to create a Docker image and push to Docker Registry

[chaitanyarahalkar]

This PR addresses #2330

Add automated Docker image builds

This PR adds a GitHub Actions workflow that automatically builds and publishes DevDocs Docker images to GitHub Container Registry (GHCR). The workflow addresses the concern of outdated official Docker images by providing fresh builds on a regular schedule.

What this adds:

• New workflow .github/workflows/docker-build.yml that:

• Runs monthly on the 1st of each month

• Can be manually triggered via GitHub Actions UI

• Builds both regular and Alpine-based images

• Publishes to GHCR with the following tags:

  • ghcr.io/[org]/devdocs:latest
  • ghcr.io/[org]/devdocs:[YYYYMMDD]
  • ghcr.io/[org]/devdocs:alpine
  • ghcr.io/[org]/devdocs:alpine-[YYYYMMDD]

  The administrators for the repo would need to do the following -

1. Enable GitHub Container Registry:

• Go to repository "Settings" → "Actions" → "General"
• Under "Workflow permissions", ensure "Read and write permissions" is selected
• Save the changes
• Enable Package Write Permissions:

2. Go to repository "Settings" → "Packages"

• Ensure "Inherit access from source repository" is enabled
• If not using inheritance, explicitly grant write access to GitHub Actions

3. Optional but recommended - Branch Protection

• Go to repository "Settings" → "Branches"
• Add branch protection rule for your main branch
• Enable "Require status checks to pass before merging"
• This ensures the Docker build workflow succeeds before merging

I believe no other changes are needed here.

[simon04]

Cool, thank you for woking on this feature. Some remarks:

• Please update the README for usage instructions ("Alternatively, DevDocs may be started as a Docker container"; maybe move the Docker instructions up since they are much simpler?)
• Steps for standard and alpine are very much alike. Have you considered using matrix? Does it make sense here?
• The audit tool zizmor outputs one warning (see below)

@ojeytonwilliams, I would love to hear your thoughts on this PR. 😄

> uvx zizmor .github/workflows/docker-build.yml 
warning[artipacked]: credential persistence through GitHub Actions artifacts
  --> /Users/simon/src/devdocs/.github/workflows/docker-build.yml:16:9
   |
16 |         - name: Checkout repository
   |  _________-
17 | |         uses: actions/checkout@v4
   | |_________________________________- does not set persist-credentials: false
   |
   = note: audit confidence → Low

[ojeytonwilliams]

It looks like this is a good approach, but I noticed a couple of strange things.

"Settings" → "Packages" doesn't seem to exist. Perhaps it won't until we publish the first one, I'm not sure.

Branch protection rules don't seem relevant when we're running this via workflow dispatch or cron.

Other than that (and what Simon pointed out), I think this all makes sense.

[chaitanyarahalkar]

@ojeytonwilliams I believe that setting change is not needed to be done. It should work out of the box..

@simon04 added the matrix option for the build image.. I believe the warning should go as well since added the option to not persist credentials. Updated the README as well.

Let me know if these changes look good to y'all!

Thanks for your comments!

[ojeytonwilliams]

Great, thanks for confirming @chaitanyarahalkar

@simon04 I'm happy with this if you are.

[simon04]

Great! Let's give it a try. 😄

[ojeytonwilliams]

And there it is: https://github.com/freeCodeCamp/devdocs/pkgs/container/devdocs

Cheers!