Task 5: Publish images

[FPurichaya]

Task

Task 5: Publish images

What changed

• Added .github/workflows/cd.yml — builds and pushes container images to GHCR on push to main and workflow_dispatch
• Publishes:
  ghcr.io///api
  ghcr.io///web
• Auth via GITHUB_TOKEN (no PAT)
• Permissions: contents: read, packages: write, id-token: write, attestations: write
• Tags: sha- (immutable) and main (moving); no latest
• SBOM + provenance enabled; builds for linux/amd64 and linux/arm64
• Updated README with an Images section (names + tag scheme)

How to verify

• Workflow static check

actionlint .github/workflows/cd.yml

Result: no errors (workflow syntax and expressions OK).

• CI (same Dockerfiles, no GHCR push)

Open the PR CI run → images job green (builds API and web for linux/amd64).
Confirms Dockerfiles still build on GitHub-hosted runners; CD adds push, multi-arch, SBOM, and provenance.

Security checklist

• Third-party GitHub Actions are pinned to a full 40-character commit SHA, with the release tag in a trailing comment
• Third-party container images are pinned by manifest-list digest, with the version tag recorded next to the digest
• No latest image tags and no floating action tags (@v4, @main)
• No secrets in git, Dockerfiles, image layers, or workflow logs
• Workflow permissions are set explicitly and are no broader than the job needs
• Application containers run as a non-root user
• Postgres and Valkey are not published on a public interface
• apps/ behavior is unchanged, except operational configuration this task allows

Exceptions

• None

Package visibility:
If the repo is private, packages stay private (default). If public, packages follow the repo visibility.