Pack docker image from binary

.github/workflows/docker-publish.yml

@@ -15,7 +15,10 @@ env:
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
-  build:
+  Build:
+    uses: ./.github/workflows/build.yml
+  Docker:
+    needs: Build
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -24,8 +27,29 @@ jobs:
       # with sigstore/fulcio when running outside of PRs.
       id-token: write
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - name: Create Dockerfile
+        run: |
+          cat <<EOF > Dockerfile
+          # syntax=docker/dockerfile:1
+          FROM scratch as binary-amd64
+          COPY hath-rust-aarch64-unknown-linux-gnu /hath-rust
+          
+          FROM scratch as binary-arm64
+          COPY hath-rust-aarch64-unknown-linux-gnu /hath-rust
+          
+          FROM scratch as binary-arm
+          COPY hath-rust-armv7-unknown-linux-gnueabihf /hath-rust
+          
+          FROM debian:bookworm-slim
+          WORKDIR /hath
+          COPY --from=binary-$TARGETARCH --chmod=755 /hath-rust /usr/local/bin/hath-rust
+          CMD ["hath-rust"]
+          EOF
+
+      - name: Download artifact
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
 
       # Install the cosign tool except on PR
       # https://github.com/sigstore/cosign-installer
@@ -66,7 +90,7 @@ jobs:
         uses: docker/build-push-action@v5
         with:
           context: .
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64,linux/arm64,linux/arm/v7
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}