Migrate to gar

.github/workflows/publish-on-release.yaml

@@ -7,43 +7,46 @@ name: Create and publish a Docker image on release
 on:
   push:
     branches: ['release']
+  workflow_dispatch:
 
 env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
+  REGISTRY: us-docker.pkg.dev/uwit-mci-iam/containers
+  OWNER_IMAGE: ${{ github.repository }}
 
 jobs:
-  build-and-push-image-to-ghcr:
+  build-and-push-image-to-gar:
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
-      - name: Login to ghcr.io Container registry
-        # should this be pinned?
-        # https://github.com/docker/login-action
-        uses: docker/[email protected]
+      - name: Compute repository name
+        id: image_name
+        run: |
+          # GH=uwit-iam/nginx-saml-proxy; echo ${GH#*/} returns "nginx-saml-proxy"
+          echo "IMAGE_NAME=${OWNER_IMAGE#*/}" >> $GITHUB_OUTPUT
+
+      - name: Auth to Cloud
+        uses: 'uwit-iam/action-auth-artifact-registry@main'
         with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GHCR_TOKEN }}
+          credentials: "${{ secrets.MCI_GCLOUD_AUTH_JSON }}"
 
       - name: Extract metadata (tags + labels) for Docker
         id: meta
         # should this be pinned?
         # https://github.com/docker/metadata-action
-        uses: docker/metadata-action@v4.4.0
+        uses: docker/metadata-action@v5.5.1
         with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          images: ${{ env.REGISTRY }}/${{ steps.image_name.outputs.IMAGE_NAME }}
 
       - name: Build and push Docker image
         # should this be pinned?
         # https://github.com/docker/build-push-action
-        uses: docker/build-push-action@v4.0.0
+        uses: docker/build-push-action@v6.7.0
         with:
           context: .
           push: true