From 8d08f343c930f556c6ab016be9d00b23f1e516e3 Mon Sep 17 00:00:00 2001
From: Christian Cleberg <hello@cleberg.net>
Date: Wed, 15 Jul 2026 02:55:52 -0500
Subject: ci: publish multi-arch image to GHCR on release tags

Build and push linux/amd64 + linux/arm64 images to
ghcr.io/zerolabsco/skunky-art on every v* tag, with a signed provenance
attestation. The Dockerfile cross-compiles from $BUILDPLATFORM, so the
arm64 image builds without QEMU emulation.

Default both compose examples to the published image and keep `build: .`
commented out for building from a checkout, and extend dependabot to the
github-actions and docker ecosystems.
---
 README.md | 11 +++++++++++
 1 file changed, 11 insertions(+)

(limited to 'README.md')

diff --git a/README.md b/README.md
index 396628a..9dd9d17 100755
--- a/README.md
+++ b/README.md
@@ -20,6 +20,17 @@ can also add the `-ldflags "-w -s"` argument (GCCGO has a different name for it
 
 `go build -tags embed -ldflags "-w -s"`
 
+## Docker
+Prebuilt multi-arch images (`linux/amd64`, `linux/arm64`) are published to GHCR
+on every release tag:
+
+`docker pull ghcr.io/zerolabsco/skunky-art:latest`
+
+Each release is tagged `1.3.3`, `1.3`, `1` and `latest`; pin an exact version if
+you want reproducible upgrades. `compose.example.yaml` uses this image by
+default and keeps a commented-out `build: .` for building from a checkout.
+`compose.vpn_example.yml` does the same, plus an optional VPN egress sidecar.
+
 ## Setup
 The sample config is in the `config.example.json` file. For custom config, use
 the `--config` option.
-- 
cgit v1.2.3