ci: add github workflow for publishing container images

Publish multiarch container images of the reference plugins at
ghcr.io/containerd/nri/plugins/<plugin>:<tag>

The tag is the git tag name for tagged versions and "unstable" for the
main branch.

The default-validator, network-device-injector and network-logger
plugins are skipped in the config as they are also missing from the
Makefile.

Author: marquiz

.github/workflows/images.yml

@@ -0,0 +1,80 @@
+name: Publish Container Images
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - v[0-9]+.[0-9]+.[0-9]+
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-and-push:
+    name: Build and Push (${{ matrix.image }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        image: [
+          #default-validator,
+          device-injector,
+          differ,
+          hook-injector,
+          logger,
+          #network-device-injector,
+          #network-logger,
+          template,
+          ulimit-adjuster,
+          v010-adapter,
+          wasm,
+        ]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Determine image tag name
+        id: tag
+        run: |
+          if [ "${{ github.ref_type }}" = "tag" ]; then
+              tag="${{ github.ref_name }}"
+          else
+              case "${{ github.ref_name }}" in
+                  main)
+                      tag="unstable"
+                      ;;
+              esac
+          fi
+          if [ -z "$tag" ]; then
+              echo "ERROR: failed to determine image tag"
+              exit 1
+          fi
+          echo "TAG_NAME=$tag" >> $GITHUB_ENV
+
+      - name: Build and push image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./plugins/Dockerfile
+          build-args: |
+            PLUGIN=${{ matrix.image }}
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ghcr.io/${{ github.repository }}/plugins/${{ matrix.image }}:${{ env.TAG_NAME }}
+