Update Docker release workflow

.github/workflows/docker-release.yml

@@ -8,35 +8,138 @@ on:
   workflow_dispatch:
 
 jobs:
-  build-and-push:
+  check-env:
+    permissions:
+      contents: none
     runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      check-docker: ${{ steps.check-docker.outputs.defined }}
+    steps:
+      - id: check-docker
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+        if: ${{ env.DOCKER_USERNAME != '' }}
+        run: echo "defined=true" >> $GITHUB_OUTPUT
+  release:
+    needs: check-env
+    if: needs.check-env.outputs.check-docker == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
+      id-token: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
+
+      - name: Install cosign
+        if: github.event_name != 'pull_request'
+        uses: sigstore/cosign-installer@v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v3
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata for server
+        id: meta-server
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ secrets.DOCKER_USERNAME }}/gpt-subtitle-api
+            ghcr.io/${{ github.repository }}
+          tags: |
+            type=raw,value=latest,enable=true
+            type=raw,value={{date 'YYYY-MM-DD'}},enable=true
+            type=sha,format=long,prefix=sha-,enable=true
+          flavor: latest=false
+
+      - name: Extract Docker metadata for web
+        id: meta-web
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ secrets.DOCKER_USERNAME }}/gpt-subtitle-web
+            ghcr.io/${{ github.repository }}
+          tags: |
+            type=raw,value=latest,enable=true
+            type=raw,value={{date 'YYYY-MM-DD'}},enable=true
+            type=sha,format=long,prefix=sha-,enable=true
+          flavor: latest=false
+
+
+
       - name: Build and push web image
+        id: build-and-push-web
         uses: docker/build-push-action@v2
         with:
           context: .
           file: ./apps/web/Dockerfile
           push: true
-          tags: hqwuzhaoyi/gpt-subtitle-web:latest
-          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta-web.outputs.tags }}
+          labels: ${{ steps.meta-web.outputs.labels }}
+          platforms: linux/amd64,linux/arm/v7,linux/arm64
+          cache-from: type=gha,scope=docker-release
+          cache-to: type=gha,mode=max,scope=docker-release
 
       - name: Build and push API image
+        id: build-and-push-server
         uses: docker/build-push-action@v2
         with:
           context: .
           file: ./apps/server/Dockerfile
           push: true
-          tags: hqwuzhaoyi/gpt-subtitle-api:latest
-          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta-server.outputs.tags }}
+          labels: ${{ steps.meta-server.outputs.labels }}
+          platforms: linux/amd64,linux/arm/v7,linux/arm64
+          cache-from: type=gha,scope=docker-release
+          cache-to: type=gha,mode=max,scope=docker-release
+
+      - name: Sign the published Docker image
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          COSIGN_EXPERIMENTAL: 'true'
+        run: echo "${{ steps.meta-web.outputs.tags }}" | xargs -I {} cosign sign --yes {}@${{ steps.build-and-push-web.outputs.digest }}
+
+      - name: Sign the published Docker image
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          COSIGN_EXPERIMENTAL: 'true'
+        run: echo "${{ steps.meta-server.outputs.tags }}" | xargs -I {} cosign sign --yes {}@${{ steps.build-and-push-server.outputs.digest }}
+
+  description:
+    runs-on: ubuntu-latest
+    needs: check-env
+    if: needs.check-env.outputs.check-docker == 'true'
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Docker Hub Description
+        uses: peter-evans/dockerhub-description@v4
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: ${{ secrets.DOCKER_USERNAME }}/gpt-subtitle-web
+
+      - name: Docker Hub Description
+        uses: peter-evans/dockerhub-description@v4
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: ${{ secrets.DOCKER_USERNAME }}/gpt-subtitle-api