Publish docling-serve images to ghcr and quay container repositories (#1)

* Publish docling-serve images to ghcr and quay container repositories

This commit:
- Creates container file to build the image for cpu only
and default "with gpu" images
- Adds workflow jobs to publish the images to ghcr.io and quay.io
- Makefile to build these images locally for linux/amd64 platform.

Signed-off-by: Anil Vishnoi <vishnoianil@gmail.com>

* make cpu-only version with poetry

Signed-off-by: Michele Dolfi <dol@zurich.ibm.com>

* Rename cpu/gpu image names and also update the supported platforms

Signed-off-by: Anil Vishnoi <vishnoianil@gmail.com>

---------

Signed-off-by: Anil Vishnoi <vishnoianil@gmail.com>
Signed-off-by: Michele Dolfi <dol@zurich.ibm.com>
Co-authored-by: Michele Dolfi <dol@zurich.ibm.com>

.github/workflow/images.yml

@@ -0,0 +1,152 @@
+name: Publish docling-serve images
+
+on:
+  push:
+    branches:
+      - main
+
+env:
+  GHCR_REGISTRY: ghcr.io
+  GHCR_DOCLING_SERVE_CPU_IMAGE_NAME: ${{ github.repository }}/ds4sd/docling-serve-cpu
+  GHCR_DOCLING_SERVE_GPU_IMAGE_NAME: ${{ github.repository }}/ds4sd/docling-serve
+  QUAY_REGISTRY: quay.io
+  QUAY_DOCLING_SERVE_CPU_IMAGE_NAME: ds4sd/docling-serve-cpu
+  QUAY_DOCLING_SERVE_GPU_IMAGE_NAME: ds4sd/docling-serve
+
+jobs:
+  build_and_publish_ui_image:
+    name: Push docling-serve container images to GHCR and QUAY
+    runs-on: ubuntu-latest
+    environment: registry-creds
+    permissions:
+      packages: write
+      contents: read
+      attestations: write
+      id-token: write
+
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v4
+
+      - name: Log in to the GHCR container image registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GHCR_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to the Quay container image registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.QUAY_REGISTRY }}
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Cache Docker layers
+        uses: actions/cache@v4
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-
+
+      - name: Extract metadata (tags, labels) for docling-serve/cpu ghcr image
+        id: ghcr_serve_cpu_meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_DOCLING_SERVE_CPU_IMAGE_NAME }}
+
+      - name: Extract metadata (tags, labels) for docling-serve/gpu ghcr image
+        id: ghcr_serve_gpu_meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_DOCLING_SERVE_GPU_IMAGE_NAME }}
+
+      - name: Extract metadata (tags, labels) for docling-serve/cpu quay image
+        id: quay_serve_cpu_meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.QUAY_REGISTRY }}/${{ env.QUAY_DOCLING_SERVE_CPU_IMAGE_NAME }}
+
+      - name: Extract metadata (tags, labels) for docking-serve/gpu quay image
+        id: quay_serve_gpu_meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.QUAY_REGISTRY }}/${{ env.QUAY_DOCLING_SERVE_GPU_IMAGE_NAME }}
+
+      - name: Build and push docling-serve/cpu image to ghcr.io
+        id: push-serve-cpu-ghcr
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.ghcr_serve_cpu_meta.outputs.tags }}
+          labels: ${{ steps.ghcr_serve_cpu_meta.outputs.labels }}
+          platforms: linux/amd64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          file: Containerfile
+          build-args: |
+            --build-arg CPU_ONLY=true
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_DOCLING_SERVE_CPU_IMAGE_NAME}}
+          subject-digest: ${{ steps.push-serve-cpu-ghcr.outputs.digest }}
+          push-to-registry: true
+
+      - name: Build and push docling-serve/gpu image to ghcr.io
+        id: push-serve-gpu-ghcr
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.ghcr_serve_gpu_meta.outputs.tags }}
+          labels: ${{ steps.ghcr_serve_gpu_meta.outputs.labels }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          file: Containerfile
+          build-args: |
+            --build-arg CPU_ONLY=false
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_DOCLING_SERVE_GPU_IMAGE_NAME}}
+          subject-digest: ${{ steps.push-serve-gpu-ghcr.outputs.digest }}
+          push-to-registry: true
+
+      - name: Build and push docling-serve/cpu image to quay.io
+        id: push-serve-cpu-quay
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.quay_serve_cpu_meta.outputs.tags }}
+          labels: ${{ steps.quay_serve_cpu_meta.outputs.labels }}
+          platforms: linux/amd64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          file: Containerfile
+          build-args: |
+            --build-arg CPU_ONLY=true
+
+      - name: Build and push docling-serve/gpu image to quay.io
+        id: push-serve-gpu-quay
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.quay_serve_gpu_meta.outputs.tags }}
+          labels: ${{ steps.quay_serve_gpu_meta.outputs.labels }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          file: Containerfile
+          build-args: |
+            --build-arg CPU_ONLY=false