build: build a "latest" container from main

.github/workflows/container-latest.yaml

@@ -0,0 +1,60 @@
+name: container-latest
+
+# Build a "latest" container for every commit
+
+on:
+  push:
+    branches:
+      - main
+
+concurrency: container-latest
+
+jobs:
+  build:
+    uses: ./.github/workflows/build-binary.yaml
+    with:
+      version: latest
+
+  publish:
+    needs: [ build ]
+    runs-on: ubuntu-22.04
+
+    permissions:
+      contents: write
+      packages: write
+      id-token: write
+      attestations: write
+
+    env:
+      IMAGE_NAME: trustd
+      IMAGE_TAG: latest
+
+    steps:
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - uses: actions/download-artifact@v4
+        with:
+          path: ${{ github.workspace }}/download
+
+      - name: Display downloaded content
+        run: ls -R ${{ github.workspace }}/download
+
+      # Build the container
+
+      - uses: ./.github/actions/build-container
+        with:
+          image_name: ${{ env.IMAGE_NAME }}
+          image_tag: ${{ env.IMAGE_TAG }}
+
+      # Push to ghcr.io
+
+      - name: Push to ghcr.io
+        uses: redhat-actions/push-to-registry@v2
+        with:
+          image: ${{ env.IMAGE_NAME }}
+          tags: ${{ env.IMAGE_TAG }}
+          registry: ghcr.io/${{ github.repository_owner }}
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}