ci: publish multi-arch image to GHCR on release tagsv1.3.4

Build and push linux/amd64 + linux/arm64 images to
ghcr.io/zerolabsco/skunky-art on every v* tag, with a signed provenance
attestation. The Dockerfile cross-compiles from $BUILDPLATFORM, so the
arm64 image builds without QEMU emulation.

Default both compose examples to the published image and keep `build: .`
commented out for building from a checkout, and extend dependabot to the
github-actions and docker ecosystems.

1 files changed, 11 insertions, 0 deletions

diff --git a/README.md b/README.md
index 396628a..9dd9d17 100755
--- a/README.md
+++ b/README.md
@@ -20,6 +20,17 @@ can also add the `-ldflags "-w -s"` argument (GCCGO has a different name for it
 
 `go build -tags embed -ldflags "-w -s"`
 
+## Docker
+Prebuilt multi-arch images (`linux/amd64`, `linux/arm64`) are published to GHCR
+on every release tag:
+
+`docker pull ghcr.io/zerolabsco/skunky-art:latest`
+
+Each release is tagged `1.3.3`, `1.3`, `1` and `latest`; pin an exact version if
+you want reproducible upgrades. `compose.example.yaml` uses this image by
+default and keeps a commented-out `build: .` for building from a checkout.
+`compose.vpn_example.yml` does the same, plus an optional VPN egress sidecar.
+
 ## Setup
 The sample config is in the `config.example.json` file. For custom config, use
 the `--config` option.