feat(release): add docker musl image packaging

.dockerignore

@@ -0,0 +1,17 @@
+.git
+.github
+docs
+node_modules
+skills
+src
+tests
+scripts
+AGENTS.md
+README.md
+package.json
+bun.lock
+tsconfig.json
+.mise.toml
+dist/*
+!dist/skillet-linux-x64-musl
+!dist/skillet-linux-arm64-musl

.github/workflows/docker-image.yaml

@@ -0,0 +1,66 @@
+name: Docker Image
+
+on:
+  release:
+    types:
+      - published
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+
+    env:
+      IMAGE: ghcr.io/${{ github.repository_owner }}/skillet
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+
+      - name: Setup mise
+        uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac
+
+      - name: Resolve image tag
+        id: vars
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ "${GITHUB_REF_TYPE:-}" == "tag" ]]; then
+            TAG="${GITHUB_REF_NAME#v}"
+          else
+            TAG="sha-${GITHUB_SHA::7}"
+          fi
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Build musl binaries
+        run: mise run build -- --targets=linux-x64-musl,linux-arm64-musl
+
+      - name: Authenticate to GHCR
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+      - name: Build and push multi-arch image
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker buildx create --name skillet-builder --use || docker buildx use skillet-builder
+          docker buildx build \
+            --platform linux/amd64,linux/arm64 \
+            --tag "$IMAGE:${{ steps.vars.outputs.tag }}" \
+            --push \
+            .
+
+      - name: Tag image as latest
+        if: github.event_name == 'release'
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker buildx imagetools create \
+            --tag "$IMAGE:latest" \
+            "$IMAGE:${{ steps.vars.outputs.tag }}"

.mise.toml

@@ -24,3 +24,6 @@ run = "mise run install && bun scripts/render-chocolatey-package.ts"
 
 [tasks.render-winget-manifest]
 run = "mise run install && bun scripts/render-winget-manifest.ts"
+
+[tasks.docker-smoke]
+run = "mise run build -- --targets=linux-x64-musl,linux-arm64-musl && docker build --platform=linux/amd64 -t skillet:local . && docker run --rm --platform=linux/amd64 skillet:local --help"

Dockerfile

@@ -0,0 +1,21 @@
+# syntax=docker/dockerfile:1.7
+FROM alpine:3.22
+
+ARG TARGETARCH
+
+RUN apk add --no-cache libstdc++ libgcc
+
+COPY dist/skillet-linux-x64-musl /tmp/skillet-linux-x64-musl
+COPY dist/skillet-linux-arm64-musl /tmp/skillet-linux-arm64-musl
+
+RUN set -eux; \
+  case "$TARGETARCH" in \
+    amd64) cp /tmp/skillet-linux-x64-musl /usr/local/bin/skillet ;; \
+    arm64) cp /tmp/skillet-linux-arm64-musl /usr/local/bin/skillet ;; \
+    *) echo "Unsupported TARGETARCH: $TARGETARCH" >&2; exit 1 ;; \
+  esac; \
+  chmod +x /usr/local/bin/skillet; \
+  rm -f /tmp/skillet-linux-x64-musl /tmp/skillet-linux-arm64-musl
+
+ENTRYPOINT ["/usr/local/bin/skillet"]
+CMD ["--help"]

README.md

@@ -13,7 +13,7 @@ Skillet installs, discovers, and updates `SKILL.md`-based skills across supporte
 | Chocolatey | `choco install skillet` | Configured |
 | winget | `winget install skillet` | Configured |
 | npm / npx | `npx skillet ...` | Planned |
-| Docker | `docker run ... skillet ...` | Planned |
+| Docker | `docker run ... skillet ...` | Configured |
 | Local dev | `mise run dev -- --help` | Available |
 
 Current development workflow:
@@ -144,3 +144,4 @@ Distribution docs:
 - Homebrew: `docs/distribution/homebrew.md`
 - Chocolatey: `docs/distribution/chocolatey.md`
 - winget: `docs/distribution/winget.md`
+- Docker: `docs/distribution/docker.md`

docs/distribution/docker.md

@@ -0,0 +1,32 @@
+# Docker Distribution
+
+Skillet publishes a Linux musl-based container image with `skillet` as the entrypoint.
+
+## Build Inputs
+
+The image requires these release artifacts in `dist/`:
+
+- `skillet-linux-x64-musl`
+- `skillet-linux-arm64-musl`
+
+## Local Build and Test
+
+```bash
+mise run build -- --targets=linux-x64-musl,linux-arm64-musl
+docker build --platform=linux/amd64 -t skillet:local .
+docker run --rm skillet:local --help
+```
+
+## Publish (GHCR)
+
+```bash
+docker buildx build \
+  --platform linux/amd64,linux/arm64 \
+  -t ghcr.io/echohello-dev/skillet:<version> \
+  -t ghcr.io/echohello-dev/skillet:latest \
+  --push .
+```
+
+Repository automation:
+
+- `.github/workflows/docker-image.yaml` publishes `ghcr.io/<owner>/skillet:<version>` on release.

package.json

@@ -12,7 +12,8 @@
     "build": "bun scripts/build-release.ts",
     "render:homebrew": "bun scripts/render-homebrew-formula.ts",
     "render:choco": "bun scripts/render-chocolatey-package.ts",
-    "render:winget": "bun scripts/render-winget-manifest.ts"
+    "render:winget": "bun scripts/render-winget-manifest.ts",
+    "docker:smoke": "mise run docker-smoke"
   },
   "dependencies": {
     "cac": "^6.7.14",