ci: update docker image workflow

Align a little bit more to
https://github.com/actions/starter-workflows/blob/main/ci/docker-publish.yml
in preparation for trying out cosign support

.github/workflows/docker.yml

@@ -1,11 +1,11 @@
+name: Docker
+
 on:
   push:
-    branches:
-    - 'main'
-    tags:
-    - '*'
-
-name: Publish Docker image
+    branches: [ $default-branch ]
+    tags: [ 'v*' ]
+  pull_request:
+    branches: [ $default-branch ]
 
 env:
   REGISTRY: ghcr.io
@@ -21,20 +21,28 @@ jobs:
     steps:
     - uses: actions/checkout@v2
 
-    - uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9 # v1.10.0
+    - name: Setup Docker buildx
+      uses: docker/setup-buildx-action@94ab11c41e45d028884a99163086648e898eed25 # v1.6.0
+
+    - name: Log into registry ${{ env.REGISTRY }}
+      uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9 # v1.10.0
+      if: github.event_name != 'pull_request'
       with:
         registry: ${{ env.REGISTRY }}
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
 
-    - uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+    - name: Extract Docker metadata
       id: meta
+      uses: docker/metadata-action@e5622373a38e60fb6d795a4421e56882f2d7a681 # v3.6.2
       with:
         images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
-    - uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
+    - name: Build and push Docker image
+      id: build-and-push
+      uses: docker/build-push-action@a66e35b9cbcf4ad0ea91ffcaf7bbad63ad9e0229 # v2.7.0
       with:
         context: .
-        push: true
+        push: ${{ github.event_name != 'pull_request' }}
         tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}