Publish docker image.

.github/workflows/docker.yml

@@ -3,6 +3,14 @@ name: Docker
 
 on:
   workflow_dispatch:
+    inputs:
+      ref:
+        description: "The git ref to build from (branch, tag, or commit SHA)."
+        type: string
+        required: true
+        default: main
+  release:
+    types: [published]
 
 defaults:
   run:
@@ -13,4 +21,57 @@ jobs:
     runs-on: ubuntu-latest
     permissions: {}
     steps:
-      - run: echo "Building and pushing Docker image..."
+      # Check out the repository at the specified ref so that git ls-remote can
+      # resolve branch names and git refs correctly. For workflow_dispatch, this
+      # uses the user-provided ref; for release events, this uses the published
+      # tag.
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || github.ref_name }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      # Use the published tag as the ref; set both the versioned and `latest` tags.
+      - name: Setup vars (release)
+        if: github.event_name == 'release'
+        run: |
+          ref="${{ github.ref_name }}"
+          version="${ref#v}"
+          echo "STELLAR_CLI_REF=${ref}" >> $GITHUB_ENV
+          echo "DOCKER_TAGS=stellar/cli:${version},stellar/cli:latest" >> $GITHUB_ENV
+
+      # If the ref looks like a version tag (e.g. v1.2.3), treat it like a
+      # release and include the `latest` tag. Otherwise, resolve the ref to a
+      # commit SHA via git rev-parse, which handles branch names, tags, full
+      # SHAs, and partial SHAs.
+      - name: Setup vars (workflow_dispatch)
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          ref="${{ inputs.ref }}"
+
+          if [[ "$ref" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "STELLAR_CLI_REF=${ref}" >> $GITHUB_ENV
+            echo "DOCKER_TAGS=stellar/cli:${ref#v},stellar/cli:latest" >> $GITHUB_ENV
+          elif commit="$(git rev-parse --verify "$ref^{commit}" 2>/dev/null)"; then
+            echo "STELLAR_CLI_REF=${commit}" >> $GITHUB_ENV
+            echo "DOCKER_TAGS=stellar/cli:${commit}" >> $GITHUB_ENV
+          else
+            echo "::error::Could not resolve ref '${ref}' to a commit."
+            exit 1
+          fi
+
+      - name: Build and push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          build-args: STELLAR_CLI_REF=${{ env.STELLAR_CLI_REF }}
+          tags: ${{ env.DOCKER_TAGS }}

Dockerfile

@@ -8,7 +8,7 @@ RUN apt-get update && \
 
 RUN git clone https://github.com/stellar/stellar-cli.git /tmp/stellar-cli && \
     cd /tmp/stellar-cli && \
-    git fetch origin "${STELLAR_CLI_REF}" && \
+    git fetch origin && \
     git checkout "${STELLAR_CLI_REF}" && \
     cargo install --locked --path cmd/stellar-cli && \
     rm -rf /tmp/stellar-cli