From e38aa8f009e53ae97cdf7c0f82b4e3b3ebf22725 Mon Sep 17 00:00:00 2001
From: Yann Lacroix <yann.lacroix@advans-group.com>
Date: Thu, 29 Oct 2026 23:46:53 +0100
Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=91=B7=20build=20and=20publish=20ko?=
 =?UTF-8?q?=20images=20to=20GHCR=20with=20GitHub=20Actions?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/images.yml | 59 ++++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 .github/workflows/images.yml

diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml
new file mode 100644
index 0000000..6b79579
--- /dev/null
+++ b/.github/workflows/images.yml
@@ -0,0 +1,59 @@
+name: images
+
+# PRs only build; pushes to main publish :latest and tags (v*) publish :<tag> to GHCR.
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  images:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        dir: [microservices/vote, microservices/worker, microservices/result, monolith]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: ${{ matrix.dir }}/go.mod
+          cache-dependency-path: ${{ matrix.dir }}/go.sum
+
+      - uses: ko-build/setup-ko@v0.9
+        with:
+          version: v0.19.1
+
+      - name: Log in to GHCR
+        if: github.event_name != 'pull_request'
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | ko login ghcr.io --username "${{ github.actor }}" --password-stdin
+
+      - name: Build and publish
+        working-directory: ${{ matrix.dir }}
+        env:
+          REPO: ${{ github.repository }}
+          PUBLISH: ${{ github.event_name != 'pull_request' }}
+          TAG: ${{ github.ref_type == 'tag' && github.ref_name || 'latest' }}
+        run: |
+          # GHCR requires a lowercase repository name; ko names images <repo>/<dir>.
+          export KO_DOCKER_REPO="ghcr.io/${REPO,,}"
+          if [ "$PUBLISH" = true ]; then
+            ko build --base-import-paths --sbom=none --tags="$TAG" \
+              --platform=linux/amd64,linux/arm64 .
+          else
+            # Build only: no push, nothing leaves the runner.
+            ko build --base-import-paths --sbom=none --push=false \
+              --platform=linux/amd64,linux/arm64 .
+          fi

From 2dc6ef7f8ff7e7d2009d979570b0b372133799c9 Mon Sep 17 00:00:00 2001
From: Yann Lacroix <yann.lacroix@advans-group.com>
Date: Thu, 29 Oct 2026 23:48:26 +0100
Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=91=B7=20trigger=20image=20publish=20?=
 =?UTF-8?q?on=20x.x.x=20tags?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/images.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml
index 6b79579..8dbc649 100644
--- a/.github/workflows/images.yml
+++ b/.github/workflows/images.yml
@@ -1,10 +1,10 @@
 name: images
 
-# PRs only build; pushes to main publish :latest and tags (v*) publish :<tag> to GHCR.
+# PRs only build; pushes to main publish :latest and tags (x.x.x) publish :<tag> to GHCR.
 on:
   push:
     branches: [main]
-    tags: ['v*']
+    tags: ['[0-9]+.[0-9]+.[0-9]+']
   pull_request:
 
 permissions: