Publish multi-platform image to GHCR

Add GitHub Actions workflow to build and publish a multi-platform container image to GHCR (linux/amd64, linux/arm64, linux/arm/v7) with latest and immutable sha-<commit> tags (.github/workflows/docker.yml). Update compose.yaml to pull the published image (ghcr.io/bi119ate5hxk/sunray2server:latest) and set pull_policy: always, and add compose.build.yaml to allow local-build overlay for development. Update README with usage details (pulling, deploying a specific SHA tag, GHCR auth, and how to use the compose build overlay).

Author: bi119aTe5hXk

.github/workflows/docker.yml

@@ -0,0 +1,59 @@
+name: Publish container image
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+concurrency:
+  group: container-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  IMAGE_NAME: ghcr.io/bi119ate5hxk/sunray2server
+
+jobs:
+  publish:
+    name: Build and publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Generate image metadata
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=latest
+            type=sha,format=long,prefix=sha-
+
+      - name: Build and publish image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

README.md

@@ -407,7 +407,32 @@ Linux Docker host:
 ```sh
 cp config.yaml.template config.yaml
 # Edit config.yaml for the remote target and routing.
-SUNRAY_CONFIG=./config.yaml docker compose up --build
+SUNRAY_CONFIG=./config.yaml docker compose up
+```
+
+The default Compose file pulls
+`ghcr.io/bi119ate5hxk/sunray2server:latest`. Every push to `main` publishes a
+new multi-platform image for `linux/amd64`, `linux/arm64`, and `linux/arm/v7`,
+plus an immutable `sha-<full-commit-sha>` tag. To deploy a particular revision,
+set `image` in `compose.yaml` to that SHA tag. The workflow can also be run
+manually from the GitHub Actions page.
+
+GHCR must allow the deployment host to read the package. Public packages can
+be pulled anonymously; for a private package, run `docker login ghcr.io` before
+starting Compose. After a new `main` build succeeds, recreate with the latest
+published image:
+
+```sh
+docker compose pull
+SUNRAY_CONFIG=./config.yaml docker compose up
+```
+
+For local development, overlay the build file so Compose builds the current
+checkout instead of pulling GHCR:
+
+```sh
+SUNRAY_CONFIG=./config.yaml \
+docker compose -f compose.yaml -f compose.build.yaml up --build
 ```
 
 For simple local testing, set `password` directly on each VNC session in
@@ -424,7 +449,7 @@ Point Compose at that source file when starting it:
 ```sh
 SUNRAY_CONFIG=./config.yaml \
 SUNRAY_VNC_PASSWORD_FILE=/absolute/path/to/vnc_password \
-docker compose up --build
+docker compose up
 ```
 
 Compose mounts the password read-only as `/run/secrets/vnc_password`. The image
@@ -446,7 +471,7 @@ Desktop restarts, recreate the container:
 
 ```sh
 docker compose down
-SUNRAY_CONFIG=./config.yaml docker compose up --build
+SUNRAY_CONFIG=./config.yaml docker compose up
 ```
 
 Confirm from the Mac that the authentication listener is reachable:

compose.build.yaml

@@ -0,0 +1,7 @@
+services:
+  sunrayd:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: sunray2server:local
+    pull_policy: build

compose.yaml

@@ -1,9 +1,7 @@
 services:
   sunrayd:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    image: sunray2server:local
+    image: ghcr.io/bi119ate5hxk/sunray2server:latest
+    pull_policy: always
     # Required for the Sun Ray's TCP control channel and dynamic bidirectional
     # UDP display channel. On Docker Desktop, first enable host networking in
     # Settings > Resources > Network, then Apply & Restart.