dev: publish with container workflow

.github/workflows/container.yaml

@@ -1,22 +1,23 @@
-name: Container (Docker)
+name: Container
 
 on:
   push:
+    tags-ignore:
+      - "!v*"
   pull_request:
+    branches:
+      - "develop"
+      - "main"
 
 env:
   CARGO_TERM_COLOR: always
 
 jobs:
   test:
-    name: Test
+    name: Test (Docker)
     runs-on: ubuntu-latest
 
     steps:
-      - id: checkout
-        name: Checkout Repository
-        uses: actions/checkout@v3
-
       - id: setup
         name: Setup Toolchain
         uses: docker/setup-buildx-action@v2
@@ -25,7 +26,6 @@ jobs:
         name: Build
         uses: docker/build-push-action@v4
         with:
-          context: .
           file: ./Containerfile
           push: false
           load: true
@@ -37,6 +37,89 @@ jobs:
         name: Inspect
         run: docker image inspect torrust-tracker:local
 
+      - id: checkout
+        name: Checkout Repository
+        uses: actions/checkout@v3
+
       - id: compose
         name: Compose
         run: docker compose build
+
+  context:
+    name: Context
+    needs: test
+    runs-on: ubuntu-latest
+
+    outputs:
+      continue: ${{ steps.check.outputs.continue }}
+
+    steps:
+      - id: check
+        name: Check Context
+        run: |
+          if [[ "${{ github.event_name }}" == "push" && ( "${{ github.ref }}" == "refs/heads/main" || "${{ github.ref }}" == "refs/heads/develop" || "${{ github.ref }}" == "refs/heads/docker" ) ]] ||
+             [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" =~ ^refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            if [[ "${{ github.repository }}" == "torrust/torrust-tracker" ]]; then
+              echo "Context is torrust/torrust-tracker, and push is: main, develop, docker, or a tag of v*.*.*"
+              echo "continue=true" >> $GITHUB_OUTPUT
+            fi
+          fi
+
+  secrets:
+    name: Secrets
+    needs: context
+    environment: dockerhub-torrust
+    if: needs.context.outputs.continue == 'true'
+    runs-on: ubuntu-latest
+
+    outputs:
+      continue: ${{ steps.check.outputs.continue }}
+
+    steps:
+      - id: check
+        name: Check
+        env:
+          DOCKER_HUB_ACCESS_TOKEN: "${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}"
+        if: "${{ env.DOCKER_HUB_ACCESS_TOKEN != '' }}"
+        run: echo "continue=true" >> $GITHUB_OUTPUT
+
+  publish:
+    name: Publish
+    environment: dockerhub-torrust
+    needs: secrets
+    if: needs.secrets.outputs.continue == 'true'
+    runs-on: ubuntu-latest
+
+    steps:
+      - id: meta
+        name: Docker meta
+        uses: docker/metadata-action@v4
+        with:
+          images: |
+            "${{ secrets.DOCKER_HUB_USERNAME }}/${{secrets.DOCKER_HUB_REPOSITORY_NAME }}"
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - id: login
+        name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+
+      - id: setup
+        name: Setup Toolchain
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build and push
+        uses: docker/build-push-action@v4
+        with:
+          file: ./Containerfile
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max