ci: refactor GitHub Actions and Docker build-push-action settings

- Removed the requirement for `CR_PAT` in both GitHub action files
- Updated GitHub login to use `github.token` instead of `CR_PAT`
- Added permission settings for `contents` and `packages` in the `docker_publish.yml`
- Changed Dockerfile paths for build-push-action
- Added `RELEASE` parameter to the build-args
- Changed cache location to the registry to avoid capacity limit
- Enabled software bill of materials (sbom) and provenance features in the build-push-action.

Signed-off-by: 陳鈞 <jim60105@gmail.com>

.github/workflows/docker-reused-setup-steps/action.yml

@@ -11,8 +11,6 @@ inputs:
     required: true
   QUAY_TOKEN:
     required: true
-  CR_PAT:
-    required: true
   tag:
     required: true
 
@@ -55,14 +53,13 @@ runs:
         username: ${{ inputs.DOCKERHUB_USERNAME }}
         password: ${{ inputs.DOCKERHUB_TOKEN }}
 
-    # Create a Access Token with `read:packages` and `write:packages` scopes
-    # CR_PAT
+    # You may need to manage write and read access of GitHub Actions for repositories in the container settings.
     - name: Login to GitHub Container Registry
       uses: docker/login-action@v3
       with:
         registry: ghcr.io
         username: ${{ github.repository_owner }}
-        password: ${{ inputs.CR_PAT }}
+        password: ${{ github.token }}
 
     - name: Login to Quay Container Registry
       uses: docker/login-action@v3

.github/workflows/docker_publish.yml

@@ -11,6 +11,11 @@ on:
 
   workflow_dispatch:
 
+# Sets the permissions granted to the GITHUB_TOKEN for the actions in this job.
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   docker-alpine:
     runs-on: ubuntu-latest
@@ -39,20 +44,26 @@ jobs:
           DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
           QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
           QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
-          CR_PAT: ${{ secrets.CR_PAT }}
           tag: alpine
 
       - name: Build and push
         uses: docker/build-push-action@v5
         with:
           context: .
-          file: ./alpine.Dockerfile
+          file: ./Dockerfile
           push: true
           target: final
           tags: ${{ steps.setup.outputs.tags }}
           labels: ${{ steps.setup.outputs.labels }}
-          build-args: VERSION=${{ github.head_ref || github.ref_name }}
+          build-args: |
+            VERSION=${{ github.head_ref || github.ref_name }}
+            RELEASE=${{ github.run_number }}
           platforms: linux/amd64,linux/arm64
+          # Cache to regietry instead of gha to avoid the capacity limit.
+          cache-from: type=registry,ref=ghcr.io/${{ github.repository_owner }}/fc2-live-dl:cache
+          cache-to: type=registry,ref=ghcr.io/${{ github.repository_owner }}/fc2-live-dl:cache,mode=max
+          sbom: true
+          provenance: true
 
   docker-ubi:
     runs-on: ubuntu-latest
@@ -81,7 +92,6 @@ jobs:
           DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
           QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
           QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
-          CR_PAT: ${{ secrets.CR_PAT }}
           tag: ubi
 
       - name: Build and push
@@ -93,8 +103,15 @@ jobs:
           target: final
           tags: ${{ steps.setup.outputs.tags }}
           labels: ${{ steps.setup.outputs.labels }}
-          build-args: VERSION=${{ github.head_ref || github.ref_name }}
+          build-args: |
+            VERSION=${{ github.head_ref || github.ref_name }}
+            RELEASE=${{ github.run_number }}
           platforms: linux/amd64,linux/arm64
+          # Cache to regietry instead of gha to avoid the capacity limit.
+          cache-from: type=registry,ref=ghcr.io/${{ github.repository_owner }}/fc2-live-dl:cache
+          cache-to: type=registry,ref=ghcr.io/${{ github.repository_owner }}/fc2-live-dl:cache,mode=max
+          sbom: true
+          provenance: true
 
   docker-distroless:
     runs-on: ubuntu-latest
@@ -123,7 +140,6 @@ jobs:
           DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
           QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
           QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
-          CR_PAT: ${{ secrets.CR_PAT }}
           tag: distroless
 
       - name: Build and push
@@ -135,5 +151,12 @@ jobs:
           target: final
           tags: ${{ steps.setup.outputs.tags }}
           labels: ${{ steps.setup.outputs.labels }}
-          build-args: VERSION=${{ github.head_ref || github.ref_name }}
+          build-args: |
+            VERSION=${{ github.head_ref || github.ref_name }}
+            RELEASE=${{ github.run_number }}
           platforms: linux/amd64,linux/arm64
+          # Cache to regietry instead of gha to avoid the capacity limit.
+          cache-from: type=registry,ref=ghcr.io/${{ github.repository_owner }}/fc2-live-dl:cache
+          cache-to: type=registry,ref=ghcr.io/${{ github.repository_owner }}/fc2-live-dl:cache,mode=max
+          sbom: true
+          provenance: true