[WIP] ci: build and publish the image to ghcr on v* tags

.dockleignore

@@ -0,0 +1,11 @@
+# Only WARN and FATAL checkpoints gate at the action's exit-level=warn, so this
+# list is short. CIS-DI-0008 and DKL-LI-0003 report as INFO and are left
+# visible. The action already ignores CIS-DI-0005 and CIS-DI-0006.
+
+# No USER by design: the entrypoint needs root to chown /root to the host UID
+# before dropping via runuser. See the comment above WORKDIR in the Dockerfile.
+CIS-DI-0001
+
+# False positive on the glab layer, which apt-get installs a local .deb and so
+# never populates /var/lib/apt/lists. Drop once that RUN gains the cleanup.
+DKL-DI-0005

.github/workflows/docker.yml

@@ -0,0 +1,54 @@
+# yamllint disable rule:line-length
+---
+name: Docker
+
+# The action's push step is gated on a tag push, so the `tags:` filter is what
+# makes this publish at all. Branch and PR runs build and scan without pushing.
+"on":
+  push:
+    branches: [main]
+    tags: [v*]
+  pull_request:
+    branches: [main]
+  workflow_dispatch: {}
+
+concurrency:
+  group: docker-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  docker:
+    # Not a required check, and should stay that way: grype runs with
+    # only-fixed=false, so an unrelated upstream CVE can turn this red.
+    name: Docker build and push (amd64)
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # amd64 only — the action has no `platforms` input:
+      # schubergphilis/mcvs-docker-action#31.
+      #
+      # Do NOT add docker/setup-buildx-action before this step. The action
+      # builds with push:false and no load:true, so the image only reaches
+      # dockle, dive and `docker push` while the default docker driver is used.
+      #
+      # Scanner thresholds are fixed inside the action and steered from
+      # .hadolint.yaml, .dockleignore and .grype.yaml. Tagging is
+      # metadata-action's defaults with latest=false, so a v0.1.0 tag publishes
+      # :v0.1.0 and nothing else.
+      - uses: schubergphilis/mcvs-docker-action@006747742805f19e0f5a97eeeeed8cac6cf45130 # v0.11.6
+        with:
+          images: ghcr.io/${{ github.repository }}
+          # The action passes an empty sensitive-word, which makes dockle's
+          # CIS-DI-0010 regex end in an `.*` alternative — so EVERY NAME=value
+          # token in layer history is FATAL and this list is the only
+          # suppression. It reports one key per line per run, so this is the
+          # exhaustive set: the base image's own tokens (Canonical's
+          # rockcraft/umoci build) plus this Dockerfile's.
+          dockle-accept-key: --clear,org.opencontainers.image.created,org.opencontainers.image.description,org.opencontainers.image.title,org.opencontainers.image.version,PATH,--chmod,--strip-components,ARCH,CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS,DISABLE_AUTOUPDATER,GOBIN,GOPATH,GOROOT,GO_SHA256_AMD64,GO_SHA256_ARM64,GO_VERSION,IS_SANDBOX,LANG,LC_ALL,NODE_VERSION,SHA,TASK_VERSION,URL,nodejs,task,owner
+          token: ${{ secrets.GITHUB_TOKEN }}

.grype.yaml

@@ -0,0 +1,29 @@
+---
+# The action hardcodes severity-cutoff=high, fail-build=true and
+# only-fixed=false, and the scan runs before the push — so without these rules
+# nothing can ever publish. Rules are scoped by package type or location rather
+# than by CVE so they do not go stale. deb findings, and npm findings outside
+# npm's own bundle, stay enforced.
+ignore:
+  # Go stdlib and vendored deps inside the prebuilt gh, glab and task binaries,
+  # which only an upstream rebuild moves. Scoped to /usr/bin so it does NOT
+  # cover the Go toolchain this repo pins itself at /usr/local/go — a stdlib
+  # CVE there is fixable by bumping ARG GO_VERSION and stays enforced.
+  - package:
+      type: go-module
+      location: /usr/bin/**
+    reason: Vendored code inside prebuilt upstream binaries.
+
+  # AWS CLI v2's bundled interpreter, distinct from the distro python3 deb.
+  - package:
+      name: python
+      type: binary
+    reason: AWS CLI v2's vendored interpreter; moves with pins/awscli.env.
+
+  # npm's own bundled tree, which arrives with the nodejs deb and is not
+  # resolved by anything under pins/. Scoped by location so the globals
+  # installed beside it keep their dependencies enforced. No released Node
+  # clears these: 24.20.0 still ships ip-address@10.2.0 and tar@7.5.19.
+  - package:
+      location: "**/node_modules/npm/**"
+    reason: npm's bundled deps ship with the nodejs deb; only Node moves them.