ci: deploy the built Docker image #2

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	jobs:
	lint:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Set up Ruby
	uses: ruby/setup-ruby@v1
	with:
	bundler-cache: true

	- name: Run linting
	run: \|
	bundle exec rubocop --parallel

	- name: Run security checks
	run: \|
	bundle exec bundler-audit --update
	bundle exec brakeman -q -w2

	test:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Set up Ruby
	uses: ruby/setup-ruby@v1
	with:
	bundler-cache: true

	- name: Setup database
	env:
	RAILS_ENV: "test"
	run: \|
	bin/rails db:setup

	- name: Check autoloading (zeitwerk)
	env:
	RAILS_ENV: "test"
	run: \|
	bin/rails zeitwerk:check

	- name: Run tests
	env:
	RAILS_ENV: "test"
	run: \|
	bin/rails test
	bin/rails test:system

	deploy:
	runs-on: ubuntu-latest
	needs: [lint, test]
	if: github.event_name == 'push'
	steps:
	- uses: actions/checkout@v2

	- name: Build production Docker image
	run: \|
	docker build --tag ${{ secrets.REGISTRY_HOST }}/${{ secrets.REGISTRY_USERNAME }}/operum:main .

	- name: Push Docker image
	run: \|
	# The login is done with the default docker password storage, which is
	# not the safest around, but it will be removed by a subsequent logout
	# later on.
	docker login -u "${{ secrets.REGISTRY_USERNAME }}" -p "${{ secrets.REGISTRY_PASSWORD }}" ${{ secrets.REGISTRY_HOST }}
	docker push ${{ secrets.REGISTRY_HOST }}/${{ secrets.REGISTRY_USERNAME }}/operum:main
	docker logout ${{ secrets.REGISTRY_HOST }}

Provide feedback