ci: publish an image for every pull request

- version.sh --build appends the -pr.<number> suffix

.github/workflows/build.yaml

@@ -35,6 +35,7 @@ jobs:
       - id: version
         env:
           BRANCH: ${{ github.base_ref || github.ref_name }}
+          PULL_REQUEST: ${{ github.event.pull_request.number }}
         run: |
           coolify="$(scripts/version.sh --build)"
           echo "coolify=$coolify" >> "$GITHUB_OUTPUT"

.github/workflows/pull-request.yaml

@@ -0,0 +1,53 @@
+name: Pull request
+
+on:
+  pull_request:
+
+permissions: {}
+
+cache-mode: none
+
+concurrency:
+  group: pull-request-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build:
+    name: Build
+    permissions:
+      contents: read
+    uses: $/.github/workflows/build.yaml
+
+  publish:
+    name: Publish pr-${{ github.event.pull_request.number }}
+    needs: build
+    if: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]' }}
+    permissions:
+      packages: write # push the image of the pull request to ghcr.io
+    runs-on: ubuntu-26.04 # https://github.com/actions/runner-images
+    timeout-minutes: 30
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # https://github.com/actions/download-artifact/releases/tag/v8.0.2
+        with:
+          pattern: image-*
+          path: ${{ runner.temp }}/images
+
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # https://github.com/docker/login-action/releases/tag/v4.7.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push the image of the pull request
+        env:
+          TAG: pr-${{ github.event.pull_request.number }}
+        run: |
+          sources=()
+          for index in "$RUNNER_TEMP"/images/*/index.json; do
+            sources+=("oci-layout://${index%/index.json}@$(jq -r '.manifests[0].digest' "$index")")
+          done
+          docker buildx imagetools create --tag "ghcr.io/coollabsio/coolify:$TAG" "${sources[@]}"

RELEASE.md

@@ -118,6 +118,14 @@ Every release is tagged `v<version>`, such as `v4.6.0-beta.1`, and publishes the
 > [!IMPORTANT]
 > Cut `v4.x` from `main`, or bring an existing one up to date with `main`, before `release/v5.0` is merged into `main`. Afterwards `main` is v5 and v4 lives on `v4.x` alone.
 
+## Pull requests
+
+Every push to a pull request from a branch of this repository publishes `ghcr.io/coollabsio/coolify:pr-<number>`, versioned `<version of the base branch>-pr.<number>`. Pull request 1234 into `next` is `pr-1234` with the version `4.6.0-beta.1-pr.1234`, which sorts after `4.6.0-beta.1` and before `4.6.0-beta.2`.
+
+- Pull requests from forks and Dependabot are built, not published
+- Pull request builds are published to ghcr.io only, as the Docker Hub credentials are in the `release` environment, which no pull request run can use
+- Pull request builds create no git tag and no GitHub release
+
 ## CDN
 
 `scripts/sync-cdn.sh` syncs a channel of `coollabsio/coollabs-cdn` from the commit of the version it syncs: the install and upgrade scripts, the compose files, the environment file, the service templates, the GitHub releases and `versions.json`.

scripts/version.sh

@@ -3,6 +3,7 @@ set -euo pipefail
 
 OPTION="$*"
 BRANCH="${BRANCH:-}"
+PULL_REQUEST="${PULL_REQUEST:-}"
 VERSION_FILE=release.json
 ARTIFACT=coolify
 UPSTREAM_FILE=upstream.json
@@ -40,7 +41,7 @@ read_version() {
 	version="$(artifact_version "$channel")"
 	[ -n "$version" ] || die "$VERSION_FILE has no $channel version of $ARTIFACT"
 	if [ "$OPTION" = --build ]; then
-		echo "$version"
+		echo "$version${PULL_REQUEST:+-pr.$PULL_REQUEST}"
 		exit 0
 	fi
 }