tech(deploy): add action for deployment

[LuftigerLuca]

Summary by CodeRabbit

• Chores
  • Added GitHub Actions workflow for automated Docker image building and publishing to GitHub Container Registry. Images are tagged with both latest and version-specific identifiers, enabling simplified release management through manual workflow invocation.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a new manually triggered GitHub Actions workflow (.github/workflows/deploy-ghcr.yml) that authenticates to GHCR using GITHUB_TOKEN, extracts the version value from build.gradle, and builds and pushes a Docker image tagged as both latest and the extracted version string.

Changes

GHCR Docker Publish Workflow

Layer / File(s)	Summary
GHCR publish workflow definition .github/workflows/deploy-ghcr.yml	Introduces workflow_dispatch-triggered workflow with contents: read and packages: write permissions; logs into ghcr.io, extracts version from build.gradle via shell, and runs docker/build-push-action pushing latest and versioned tags.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

Possibly related PRs

• AllesLockr/Backend#45: Also adds a manually triggered GitHub Actions workflow for building and pushing a Docker image, making it closely related to this new GHCR deployment workflow.

Suggested reviewers

• wan0v
• Leviasm

Poem

🐇 Hop, hop, into the registry we go,
A workflow_dispatch sets the build aglow,
Extracts the version, tags it just right,
latest and versioned, pushed overnight,
The container ships off with a gleeful "Go!"

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is vague and generic, using the non-descriptive term 'add action for deployment' without specifying what deployment action is being added or its purpose.	Consider a more specific title like 'tech(deploy): add GitHub Actions workflow for GHCR Docker image deployment' to clearly convey the specific deployment mechanism being added.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/deploy-ghcr.yml:
- Around line 24-26: The version extraction step in the Extract version from
build.gradle task uses a brittle grep pattern that depends on exactly four
leading spaces before the version key, which can silently fail if build.gradle
formatting changes and produce an empty version value that breaks downstream
publish steps. Replace the fixed-spacing grep pattern with a more flexible regex
that matches the version line regardless of whitespace formatting, and add
validation logic after the extraction to fail the step immediately if the
version is empty or cannot be parsed, ensuring errors are caught early rather
than silently producing broken artifacts.
- Line 15: The actions/checkout@v4 step is persisting Git credentials in the
config, but since this workflow only performs Docker login and image build
operations with no authenticated Git operations after checkout, disable
credential persistence to reduce token exposure. Add the persist-credentials
parameter set to false to the actions/checkout@v4 step to prevent the
credentials from being stored in git config.
- Line 15: Replace all mutable version tags in the `uses:` statements with full
commit SHAs to strengthen supply-chain integrity. The `actions/checkout@v4`,
`actions/setup-python@v3`, and `actions/upload-artifact@v6` statements currently
use mutable tags that could change, so pin each of these actions to their
specific commit SHAs instead of version tags like `@v4`, `@v3`, and `@v6`. This
ensures the exact versions of these GitHub Actions are locked and cannot be
unexpectedly modified.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 905ca59a-7524-4b5b-ae8c-2de4edb67743

📥 Commits

Reviewing files that changed from the base of the PR and between 9371bde and a327162.

📒 Files selected for processing (1)

• .github/workflows/deploy-ghcr.yml