Docker image versioning and security enhancements proposal

[kaffolder7]

Hey @rajnandan1, I'm currently wrapping up some work on refactoring the project to support multi-arch for the Docker build and as a part of this process, I would like to also update your GitHub Action to support Docker Buildx build arguments (in addition to some some other improvements).

I have a few questions for ya that I would like your input/thoughts on...

Questions:

1. Should we consider adding additional versions of built images?
   This would then allow for SemVer, major-minor, major, and named versions. I'll provide a table below as to what I'm considering. (As an example, assume the release version is 3.0.9)

   Image Tag	Details	Proposed Additions
   Debian base (default)
   latest	Points to latest semantic version release	Already exists in current workflow
   3.0.9	Current release	Already exists in current workflow
   3.0	Major-minor version – points to latest 3.0.x release	✅
   3	Major version – points to latest 3.x.x release	✅
   Alpine base (smallest image size)
   alpine	Points to latest semantic version release	✅
   3.0.9-alpine	Current release	✅
   3.0-alpine	Major-minor version – points to latest 3.0.x release	✅
   3-alpine	Major version – points to latest 3.x.x release	✅

Improvements:

1. Should I consider adding the cosign tool (sigstore/cosign-installer) to the Action workflow?
   This would provide several key benefits, particularly when working with the container images, artifacts, and supply chain security:
   • We can securely sign and verify container images, ensuring others that they originated from a trusted source
   • Will help to automate signature verification, which in turn helps to verify the integrity and authenticity of an image before deploying a container.
   • Yields compliance with supply chain security standards
   • Provides provenance and build attestations

Let me know your thoughts and I'll quick get these updates made and a PR opened for ya! 😀

[rajnandan1]

Hi I will be honest here. I am not a docker expert. So, if you feel these would optimise the current image and thus helping users, I would request you to go ahead and raise a PR.

And thank you so much for helping the repo here.