feat: compile static binary as release assets and docker image

.github/workflows/docker.yml

@@ -1,53 +1,127 @@
-name: Build & Push
+name: Push Docker Images
 # Build & Push builds the finschia docker image on every tag push
 
 on:
-  pull_request:
-    branches:
-      - main
   push:
     tags:
       - "v[0-9]+.[0-9]+.[0-9]+" # Push events to matching v*, i.e. v1.0, v20.15.10
       - "v[0-9]+.[0-9]+.[0-9]+-*" # Push events to matching v*, i.e. v1.0-rc1, v20.15.10-alpha1
 
 env:
   registry: docker.io
-  repository: finschia/finschianode
+  DOCKER_REPOSITORY: finschia/finschianode
+  RUNNER_BASE_IMAGE_DISTROLESS: gcr.io/distroless/static-debian11
+  RUNNER_BASE_IMAGE_NONROOT: gcr.io/distroless/static-debian11:nonroot
+  RUNNER_BASE_IMAGE_ALPINE: alpine:3.17
 jobs:
-  build:
+  docker_build_and_push:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - name: Check out the repo
+        uses: actions/checkout@v3
         with:
           fetch-depth: 0
+
       - name: Create a context for buildx
         run: docker context create buildx
+
       - name: Set up docker buildx
         id: buildx
         uses: docker/setup-buildx-action@v2
         with:
           endpoint: buildx
           config-inline: |
             [registry."docker.io"]
-      - name: login to the registry
+
+      - name: Login to the registry
         uses: docker/login-action@v2
         if: github.event_name != 'pull_request'
         with:
           registry: ${{env.registry}}
           username: ${{secrets.DOCKERHUB_USERNAME}}
           password: ${{secrets.DOCKERHUB_TOKEN}}
-      - name: extract metadata for docker
+
+      - name: Find go version
+        id: find_go_version
+        run: |
+          GO_VERSION=$(cat go.mod | grep -E 'go [0-9].[0-9]+' | cut -d ' ' -f 2)
+          echo "GO_VERSION=$GO_VERSION" >> $GITHUB_ENV
+
+      - name: Find Ostracon version
+        id: find_ostracon_version
+        run: |
+          OST_VERSION=$(go list -m github.com/Finschia/ostracon | sed 's:.* ::')
+          echo "OST_VERSION=$OST_VERSION" >> $GITHUB_ENV
+
+      - name: Parse tag
+        id: tag
+        run: |
+          ref='refs/tags/'
+          if [[ ${{ github.ref }} == *${ref}* ]]; then
+            VERSION=$(echo ${{ github.ref_name }} | sed "s/v//")
+            echo "VERSION=$VERSION" >> $GITHUB_ENV
+          else
+            echo "VERSION=${{ github.sha }}" >> $GITHUB_ENV
+          fi
+
+      - name: Extract metadata for docker
         id: meta
         uses: docker/metadata-action@v4
         with:
-          images: ${{env.registry}}/${{env.repository}}
+          images: ${{env.registry}}/${{env.DOCKER_REPOSITORY}}
           tags: |
             type=semver,pattern={{version}}
-      - name: docker build
+
+      # Distroless Docker image (default)
+      - name: Build and push (distroless)
+        uses: docker/build-push-action@v4
+        with:
+          file: Dockerfile
+          context: .
+          push: ${{github.event_name != 'pull_request'}}
+          platforms: linux/amd64,linux/arm64
+          build-args: |
+            GO_VERSION=${{ env.GO_VERSION }}
+            RUNNER_IMAGE=${{ env.RUNNER_BASE_IMAGE_DISTROLESS }}
+            GIT_VERSION=${{ env.VERSION }}
+            GIT_COMMIT=${{ github.sha }}
+            OST_VERSION=${{ env.OST_VERSION }}
+          tags: |
+            ${{ env.DOCKER_REPOSITORY }}:${{ env.VERSION }}
+          labels: ${{steps.meta.outputs.labels}}
+
+      # Alpine Docker image
+      - name: Build and push (alpine)
         uses: docker/build-push-action@v4
         with:
+          file: Dockerfile
+          context: .
           push: ${{github.event_name != 'pull_request'}}
-          build-args: ARCH=x86_64
-          tags: ${{steps.meta.outputs.tags}}
+          platforms: linux/amd64,linux/arm64
+          build-args: |
+            GO_VERSION=${{ env.GO_VERSION }}
+            RUNNER_IMAGE=${{ env.RUNNER_BASE_IMAGE_ALPINE }}
+            GIT_VERSION=${{ env.VERSION }}
+            GIT_COMMIT=${{ github.sha }}
+            OST_VERSION=${{ env.OST_VERSION }}
+          tags: |
+            ${{ env.DOCKER_REPOSITORY }}:${{ env.VERSION }}-alpine
           labels: ${{steps.meta.outputs.labels}}
-          platforms: linux/amd64
+
+      # Distroless nonroot Docker image
+      - name: Build and push (nonroot)
+        uses: docker/build-push-action@v4
+        with:
+          file: Dockerfile
+          context: .
+          push: ${{github.event_name != 'pull_request'}}
+          platforms: linux/amd64,linux/arm64
+          build-args: |
+            GO_VERSION=${{ env.GO_VERSION }}
+            RUNNER_IMAGE=${{ env.RUNNER_BASE_IMAGE_NONROOT }}
+            GIT_VERSION=${{ env.VERSION }}
+            GIT_COMMIT=${{ github.sha }}
+            OST_VERSION=${{ env.OST_VERSION }}
+          tags: |
+            ${{ env.DOCKER_REPOSITORY }}:${{ env.VERSION }}-nonroot
+          labels: ${{steps.meta.outputs.labels}}