From d781d2fadcad821b9ac613458832190c1d264c41 Mon Sep 17 00:00:00 2001
From: zihluwang <real@zihluwang.me>
Date: Mon, 31 Aug 2026 11:59:37 +0800
Subject: [PATCH] fix(docker): multi-stage build and publish tags

- Split Dockerfile into builder and runtime stages
- Put .venv on PATH so pymodbus resolves in the container
- Push image to Docker Hub and GHCR with latest and 7-char SHA tags
- Use real repo/image names in README
---
 .github/workflows/docker-publish.yml | 23 ++++++++++++++++++-----
 Dockerfile                           | 14 +++++++++++---
 README.md                            |  8 ++++----
 3 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index a02d06d..514c7d2 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -1,4 +1,4 @@
-name: Build and Push to Docker Hub
+name: Build and Push Docker Image
 
 on:
   push:
@@ -9,9 +9,12 @@ on:
     branches: [main]
 
 env:
-  REGISTRY: docker.io
   IMAGE_NAME: ${{ secrets.DOCKERHUB_USERNAME }}/modbus-slave
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -30,17 +33,27 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Extract metadata
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ env.IMAGE_NAME }}
+          images: |
+            ${{ env.IMAGE_NAME }}
+            ghcr.io/${{ github.repository }}
           tags: |
-            type=ref,event=branch
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=sha,prefix=
             type=ref,event=pr
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
-            type=sha,prefix=
 
       - name: Build and push
         uses: docker/build-push-action@v6
diff --git a/Dockerfile b/Dockerfile
index b3eeb23..1ac4fae 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,18 @@
-FROM python:3.11-slim
+# Stage 1: build and install dependencies
+FROM python:3.11-slim AS builder
 
 WORKDIR /app
 
-# Install dependencies
 COPY pyproject.toml uv.lock ./
-RUN pip install uv && uv sync --frozen
+RUN pip install --no-cache-dir uv && uv sync --frozen --no-dev --no-install-project
+
+# Stage 2: runtime (slim, no build toolchain)
+FROM python:3.11-slim AS runtime
+
+WORKDIR /app
+
+COPY --from=builder /app/.venv ./.venv
+ENV PATH="/app/.venv/bin:$PATH"
 
 # Copy application
 COPY main.py ./
diff --git a/README.md b/README.md
index 6abd8bf..c1e4e9a 100644
--- a/README.md
+++ b/README.md
@@ -15,7 +15,7 @@ A configurable Modbus slave simulator for testing Modbus TCP, RTU, and TLS conne
 ### From Source
 
 ```bash
-git clone <repository-url>
+git clone https://github.com/zihluwang/modbus-slave
 cd modbus-slave
 pip install -r requirements.txt
 ```
@@ -23,7 +23,7 @@ pip install -r requirements.txt
 ### With Docker
 
 ```bash
-docker pull <username>/modbus-slave
+docker pull zihluwang/modbus-slave
 ```
 
 ## Usage
@@ -51,10 +51,10 @@ python main.py --holding-registers-default 100 --coils-default true
 
 ```bash
 # Run with defaults
-docker run -p 5020:5020 <username>/modbus-slave
+docker run -p 5020:5020 zihluwang/modbus-slave
 
 # Run with custom arguments
-docker run -p 5020:5020 <username>/modbus-slave --holding-registers-size 1000
+docker run -p 5020:5020 zihluwang/modbus-slave --holding-registers-size 1000
 ```
 
 ## Command Line Options