ci: publish editor image to GHCR

.github/workflows/release.yml

@@ -70,6 +70,7 @@ jobs:
     permissions:
       contents: write
       id-token: write
+      packages: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -301,6 +302,48 @@ jobs:
             echo "📦 Published @pascal-app/editor@$EDITOR_VERSION"
           fi
 
+      - name: Prepare Docker image tags
+        if: inputs.package == 'editor' || inputs.package == 'all'
+        id: docker-tags
+        env:
+          BUMP: ${{ inputs.bump }}
+        run: |
+          {
+            echo 'tags<<EOF'
+            echo "ghcr.io/pascalorg/editor:$EDITOR_VERSION"
+            case "$BUMP" in
+              patch|minor|major)
+                echo "ghcr.io/pascalorg/editor:latest"
+                ;;
+            esac
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Log in to GHCR
+        if: (inputs.package == 'editor' || inputs.package == 'all') && inputs.dry-run == false
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up QEMU
+        if: inputs.package == 'editor' || inputs.package == 'all'
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        if: inputs.package == 'editor' || inputs.package == 'all'
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build & publish Docker image
+        if: inputs.package == 'editor' || inputs.package == 'all'
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: ${{ inputs.dry-run == false }}
+          tags: ${{ steps.docker-tags.outputs.tags }}
+
       - name: Build & publish nodes
         if: inputs.package == 'nodes' || inputs.package == 'all'
         working-directory: packages/nodes

Dockerfile

@@ -1,6 +1,7 @@
 # Matches `packageManager` in package.json and the version CI installs — a skew
 # here is what makes `--frozen-lockfile` fail inside the image but not locally.
 FROM oven/bun:1.3.14-alpine
+LABEL org.opencontainers.image.source="https://github.com/pascalorg/editor"
 WORKDIR /app
 
 # `next build` runs under `node`, and this image's `node` is a shim that re-execs

SETUP.md

@@ -34,8 +34,19 @@ Local development and the official hosted editor work without any environment va
 docker compose up -d
 ```
 
-The editor will be running at **http://localhost:3000**. Saved scenes live in
-the `pascal-data` volume, so they survive `docker compose down`.
+The editor will be running at **http://localhost:3000**. Compose pulls the official
+image from GHCR; set `IMAGE_TAG` to use a release instead of `latest`:
+
+```bash
+IMAGE_TAG=1.0.0 docker compose up -d
+```
+
+The `editor` package must be public in the `pascalorg` organization's GHCR packages
+for unauthenticated deployments. After the first release, open the package settings
+under the organization's Packages page, set its visibility to **Public**, and connect
+it to `pascalorg/editor`. Maintainers only need to configure this once.
+
+Saved scenes live in the `pascal-data` volume, so they survive `docker compose down`.
 
 Docker defaults `MINT_PASCAL_HOST_ORIGIN` to `http://localhost:3000`. Override
 it when hosting Pascal at another origin:

docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   editor:
-    build: .
+    image: ghcr.io/pascalorg/editor:${IMAGE_TAG:-latest}
     ports:
       # Keep the container port at 3000. `/scenes` fetches its own API through a
       # base URL that only `NEXT_PUBLIC_APP_URL` can override, and Next inlines