Publish AI Toolkit worker image automatically

.dockerignore

@@ -1,3 +1,7 @@
+.git
+.github
 __pycache__
-*.pyc
+*.py[cod]
 .pytest_cache
+.venv
+venv

.github/workflows/publish-image.yml

@@ -0,0 +1,81 @@
+name: Build and publish worker image
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: worker-image-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  IMAGE_NAME: docker.io/kalebbroo/runpod-serverless-aitoolkit
+
+jobs:
+  test:
+    name: Test worker
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install worker dependencies
+        run: python -m pip install --requirement requirements.txt
+
+      - name: Run worker tests
+        run: |
+          python -m unittest discover -s tests -v
+          python -m py_compile handler.py tests/test_handler.py
+
+  image:
+    name: Build worker image
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Sign in to Docker Hub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Generate image metadata
+        id: metadata
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.IMAGE_NAME }}
+          tags: |
+            type=sha,format=long,prefix=sha-
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+
+      - name: Build and publish worker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.metadata.outputs.tags }}
+          labels: ${{ steps.metadata.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: ${{ github.event_name != 'pull_request' && 'mode=max' || 'false' }}
+          sbom: ${{ github.event_name != 'pull_request' }}

README.md

@@ -9,6 +9,24 @@ docker build --pull --build-arg AI_TOOLKIT_REVISION=be995185f598c83abb990a088e9f
 docker push your-registry/hartsy-ai-toolkit:be995185
 ```
 
+## Automatic Docker Hub publishing
+
+The `Build and publish worker image` GitHub Actions workflow tests and builds every pull request. A push to `main`, or a manual workflow dispatch, publishes the Linux AMD64 image to:
+
+```text
+docker.io/kalebbroo/runpod-serverless-aitoolkit:latest
+docker.io/kalebbroo/runpod-serverless-aitoolkit:sha-<full-git-commit>
+```
+
+Configure these GitHub Actions repository secrets before merging the workflow:
+
+- `DOCKERHUB_USERNAME`: `kalebbroo`
+- `DOCKERHUB_TOKEN`: a Docker Hub personal access token with Read & Write permission
+
+Create the `kalebbroo/runpod-serverless-aitoolkit` Docker Hub repository first. Do not store a Docker Hub password or token in the repository. Use the immutable `sha-<full-git-commit>` tag in the RunPod template; `latest` is a convenience tag for inspection and manual testing.
+
+The workflow publishes BuildKit provenance and an SBOM with release images and uses the GitHub Actions cache for subsequent builds.
+
 Create a queue-based RunPod Serverless endpoint from that immutable image. Use one concurrent request per worker because `/dataset` and `/workspace/output` are intentionally reset for every request. Allocate enough container disk for the model cache plus dataset/output and choose a GPU configuration appropriate for the largest model families you enable. Hartsy sends a 24-hour execution policy and seven-day status TTL by default; the endpoint must permit those limits.
 
 Required worker environment: