Add support for upload application docker image to dockerhub

[adityaprakash-bobby]

It is good to have a workflow which publishes our application bundles into a docker image in dockerhub. On every successful release we can have the image pushed to public repository.

Refs:

• dockerhub
• Publishing docker images

[pallasite99]

Just some further info, this would involve:

1. Manually testing a Dockerfile located at root repo
2. Adding CI workflow for this Dockerfile in main

[shukra-in-spirit]

Just some further info, this would involve:

1. Manually testing a Dockerfile located at root repo
2. Adding CI workflow for this Dockerfile in main

Further breaking down the first point made by Pallasite:

1. Testing:
   • docker build should pass. The upload workflow will have this as a requirement.
   • todo: see if we can perform simple docker running and inspection using https://link.medium.com/bhmHQWfdgrb0
   • todo: look into including something like https://geekflare.com/container-security-scanners/ for scanning. If we are able to scan images before uploading without using any local registry/before uploading. That would be great.

[pallasite99]

@shukra-in-spirit I think it would also be a good idea to include support for multiple platforms here using qemu so that we are agnostic when it comes to building the docker image now or in the future.

Now, for the purpose of uploading image to Dockerhub ... it would be great if you can create an org account and have the settings to login protected by secrets similar to Sonar cloud setup. I believe that would be required before anyone starts working on this.

Till now, I've tested whether the base docker workflow works here with the current Dockerfile we have.

[pallasite99]

For the container scanning part, this would roughly be the steps -

1. Login to Dockerhub
2. Configure Go
3. Build the image
4. Scan the image

ex:

- name: Scan image
      uses: Azure/container-scan@v0
      with:
        image-name: ${{ secrets.ACR_LOGIN_SERVER }}/spring-petclinic:${{ github.run_number }}
        severity-threshold: CRITICAL
        run-quality-checks: true

[shukra-in-spirit]

I had created a docker organisation for us a while back. I will need to find out where it is. Will share.