publish a docker image to quay for every release

[erdii]

Intended workflow:

A new release is cut on master by creating a release and tagging it with the version
->
The build-docker workflow gets triggered and gets the version from the release tag. This also pushes the image to quay.io

Questions:

• how do i get the quay robot account credentials into the repo's secrets? (I don't have access to this (yet?)
• is quay right? Ideally this would be published under docker.io/prom/jiralert

Signed-off-by: Josh Gwosdz jgwosdz@redhat.com

[erdii]

@thetechnick did a small review of the pr and was concerned about security of the used secrets (rightfully so!)

How do we ensure that a new PR does not dump the quay credential secrets so that the attacker can replace our images (at least until we find out)?
The answer: https://securitylab.github.com/research/github-actions-preventing-pwn-requests#:~:text=Due%20to%20the%20dangers%20inherent%20to,the%20pull_request_target%20workflow%20trigger%20was%20introduced
Workflows triggered via the pull_request event cannot access repo secrets if they come from outside of this repo.

Also: pull_request_target does not have these limitations and I verified that an attack cannot change this trigger and then have the worklow actually be triggered by the new event.
Verified here: erdii/gh-actions-playground#1

TL;DR: a PR cannot extract registry secrets :)

[bwplotka]

Can we add something like https://github.com/thanos-io/thanos/blob/main/Makefile#L5 to build from main.

[bwplotka]

LGTM, just one suggestion (: