refactor(docker-ci): default to main tag for CI and require maintainer sign-off on pushed builds - #312
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughCentralizes image selection into a new Changes
Sequence Diagram(s)sequenceDiagram
participant User as Comment Author
participant Guard as Guard Job
participant SetImage as Set-Image Job
participant CI as Downstream CI Jobs
participant Wait as Wait-For-Image Workflow
participant GHCR as GHCR Registry
participant DH as Docker Hub
User->>Guard: /docker-build or /docker-cleanup (issue_comment)
Guard->>Guard: resolve PR#, validate SHA, check authorization
Guard-->>CI: allow or block comment-driven run
SetImage->>SetImage: compute image tag (pr-<n> or :main) -> output `image`
CI->>SetImage: needs.set-image.outputs.image
CI->>Wait: call with `ghcr_image`/`dh_image` (when used)
Wait->>GHCR: HEAD/manifest request (check existence + last-modified)
alt GHCR PR tag exists & fresh
Wait-->>CI: GHCR PR image ready
else
Wait->>DH: query tags API (tag_last_pushed)
alt Docker Hub PR tag exists
Wait-->>CI: Docker Hub PR image ready
else
Wait-->>CI: fallback to GHCR :main image
end
end
CI->>GHCR: push/tag (PR builds/cache)
CI->>DH: push/tag (release/main builds)
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…ub (better PR integration)
12a1510 to
4bf3940
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/ci.yml (1)
1-11:⚠️ Potential issue | 🔴 CriticalFork PRs always receive read-only GITHUB_TOKEN regardless of the permissions block, preventing the PR objective.
The PR objective is to unblock CI on PRs from forks (Docker Hub secrets unavailable). However, in public repos, workflows triggered by
pull_requestfrom a fork receive a read-onlyGITHUB_TOKEN, regardless of thepermissions:block declared at workflow or job level. This is a security restriction to prevent malicious forks from writing to the base repository's resources.Consequently:
docker-ci.ymlwould fail when run on fork PRs becausepackages: writecannot be granted to fork-triggered tokens, even though it's declared in the workflow.wait-for-imageinci.ymlwould never see apr-<N>tag and would still time out.To achieve write permissions for fork PRs, use
pull_request_targetevent instead ofpull_request, which grants read/write permissions (configurable via the permissions block) even for forks. However, this requires careful checkout of the PR head SHA to avoid security vulnerabilities. Additionally, confirm whetherpackages: readis sufficient for fork-triggered tokens to pull private packages.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/ci.yml around lines 1 - 11, Change the workflow trigger from pull_request to pull_request_target in the CI workflow so fork PRs can receive configurable write permissions, then update any jobs that expect to act on the PR head (e.g., the job that runs docker-ci.yml and the wait-for-image logic) to securely checkout the PR head commit by using actions/checkout with repository: github.event.pull_request.head.repo.full_name and ref: github.event.pull_request.head.sha (and fetch-depth: 0) instead of the default checkout; ensure the workflow permissions block includes packages: write where required for publishing/pulling and verify jobs that run code from the PR run only after explicitly checking out the head SHA to avoid executing untrusted workspace content.
🧹 Nitpick comments (3)
.github/workflows/docker-ci.yml (2)
105-107: RedundantGHCR_IMAGEenv redefinition.
GHCR_IMAGEis already defined at workflow level (line 17) and is available to all jobs. Redefining it in thenotifyjob'senv:is harmless but duplicative; removing it keeps the single source of truth.♻️ Suggested tidy-up
env: - GHCR_IMAGE: ghcr.io/${{ github.repository_owner }}/img2num-dev CLEAN_CORE_TAG: ${{ needs.build.outputs.clean_core_tag }}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/docker-ci.yml around lines 105 - 107, Redundant GHCR_IMAGE env in the notify job: remove the GHCR_IMAGE line from the notify job's env block and keep only CLEAN_CORE_TAG so the job inherits the GHCR_IMAGE value from the workflow-level env; update the notify job's env to reference only CLEAN_CORE_TAG (leave GHCR_IMAGE defined at workflow root) to ensure a single source of truth.
91-94: PR builds will rarely get a cache hit fromGHCR_IMAGE:buildcache.
cache-fromnow lists bothcache_ref(GHCR:cache-pr-<N>for PRs) andGHCR_IMAGE:buildcache. For the first build of any PR,cache-pr-<N>doesn't exist yet, so you fall back tobuildcache— butbuildcacheis only ever written by non-PR builds (line 72, 77), and PR builds usecache-to: ref=cache-pr-<N>(line 94), never refreshing the shared cache. That's fine intentionally (avoids PRs poisoning main's cache), just noting that:
- The first run on every PR pays full cold-build cost unless
main'sbuildcachehas overlapping layers for the currentDockerfile.dev.- The
cache-pr-<N>ref will be orphaned after PR close — your cleanup step handles this via thecache-pr-<N>tag match (once the regex above is fixed).No action required if this is the intended trade-off; worth a comment in the workflow so future maintainers don't "fix" it.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/docker-ci.yml around lines 91 - 94, Add a clarifying comment in the workflow near the cache configuration (referencing cache-from, cache-to, steps.meta.outputs.cache_ref and GHCR_IMAGE:buildcache) explaining that PR builds intentionally use a per-PR cache ref (cache-pr-<N>) and do not update the shared GHCR_IMAGE:buildcache, so the first PR run will be a cold build unless main's buildcache layers overlap; also note that cache-pr-<N> refs are cleaned up after PR close and this behavior is intentional to avoid poisoning main's cache..github/workflows/ci.yml (1)
22-27: Hardcoded image owner diverges fromdocker-ci.yml.
docker-ci.ymlbuilds/pushes toghcr.io/${{ github.repository_owner }}/img2num-dev(line 17), but here you hardcodeghcr.io/ryanmillard/img2num-dev. They happen to match today, but if the repo is ever transferred, forked-and-renamed, or used as a template, the two workflows will silently pull different images. Prefer a single source of truth.♻️ Suggested fix
- name: Set image id: set run: | + OWNER="${{ github.repository_owner }}" if [[ "${{ github.event_name }}" == "pull_request" ]]; then - echo "image=ghcr.io/ryanmillard/img2num-dev:pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT + echo "image=ghcr.io/${OWNER,,}/img2num-dev:pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT else - echo "image=ghcr.io/ryanmillard/img2num-dev:main" >> $GITHUB_OUTPUT + echo "image=ghcr.io/${OWNER,,}/img2num-dev:main" >> $GITHUB_OUTPUT fi(GHCR paths must be lowercase;
${OWNER,,}handles that safely.)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/ci.yml around lines 22 - 27, Replace the hardcoded GHCR owner in the run block echo lines by reading github.repository_owner into a shell variable and lowercasing it before composing the image name; e.g., set OWNER=${{ github.repository_owner }}, then use ${OWNER,,} when building the image string in the two echo "image=..." lines inside the run block so the workflow pulls the same repository owner as docker-ci.yml and remains correct if the repo owner changes.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/docker-ci.yml:
- Around line 141-156: The ignore-versions regex currently `^(?!pr-${{
github.event.pull_request.number }}|cache-pr-${{
github.event.pull_request.number }}).*` can falsely match prefixes like pr-50
when PR=5; update the value passed to ignore-versions to anchor the alternatives
to the end (e.g. `^(?!pr-${{ github.event.pull_request.number }}$|cache-pr-${{
github.event.pull_request.number }}$).*`) so only exact tag names are exempted,
and add `dry-run: true` to the Delete PR images step to verify whether the
action matches tags or manifest digests before enabling destructive behavior.
In @.github/workflows/wait-for-docker-image.yml:
- Line 18: The workflow docstring claims it checks both Docker Hub and GHCR but
the implementation still always hits Docker Hub using the URL pattern
https://hub.docker.com/v2/repositories/${IMAGE_NAME}/tags/${TAG}/ (IMAGE_NAME,
TAG at top of the file), which will 404 for ghcr.io images; update the
wait-for-image logic to detect images whose IMAGE_NAME begins with "ghcr.io/"
and, for those, call the correct GHCR registry API (e.g., query the container
manifest endpoint under GHCR or fallback to the GitHub Packages versions API for
timestamps) instead of the Docker Hub endpoint, preserving the existing
retry/backoff behavior and staleness semantics.
---
Outside diff comments:
In @.github/workflows/ci.yml:
- Around line 1-11: Change the workflow trigger from pull_request to
pull_request_target in the CI workflow so fork PRs can receive configurable
write permissions, then update any jobs that expect to act on the PR head (e.g.,
the job that runs docker-ci.yml and the wait-for-image logic) to securely
checkout the PR head commit by using actions/checkout with repository:
github.event.pull_request.head.repo.full_name and ref:
github.event.pull_request.head.sha (and fetch-depth: 0) instead of the default
checkout; ensure the workflow permissions block includes packages: write where
required for publishing/pulling and verify jobs that run code from the PR run
only after explicitly checking out the head SHA to avoid executing untrusted
workspace content.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 22-27: Replace the hardcoded GHCR owner in the run block echo
lines by reading github.repository_owner into a shell variable and lowercasing
it before composing the image name; e.g., set OWNER=${{ github.repository_owner
}}, then use ${OWNER,,} when building the image string in the two echo
"image=..." lines inside the run block so the workflow pulls the same repository
owner as docker-ci.yml and remains correct if the repo owner changes.
In @.github/workflows/docker-ci.yml:
- Around line 105-107: Redundant GHCR_IMAGE env in the notify job: remove the
GHCR_IMAGE line from the notify job's env block and keep only CLEAN_CORE_TAG so
the job inherits the GHCR_IMAGE value from the workflow-level env; update the
notify job's env to reference only CLEAN_CORE_TAG (leave GHCR_IMAGE defined at
workflow root) to ensure a single source of truth.
- Around line 91-94: Add a clarifying comment in the workflow near the cache
configuration (referencing cache-from, cache-to, steps.meta.outputs.cache_ref
and GHCR_IMAGE:buildcache) explaining that PR builds intentionally use a per-PR
cache ref (cache-pr-<N>) and do not update the shared GHCR_IMAGE:buildcache, so
the first PR run will be a cold build unless main's buildcache layers overlap;
also note that cache-pr-<N> refs are cleaned up after PR close and this behavior
is intentional to avoid poisoning main's cache.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: d9db4e6d-ab07-443b-b4e0-8964b314c48f
📒 Files selected for processing (3)
.github/workflows/ci.yml.github/workflows/docker-ci.yml.github/workflows/wait-for-docker-image.yml
Ryan-Millard
changed the title
265a917 to
7f2582e
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
14-27: Hardcoded image repo duplicatesdocker-ci.yml— consider deriving it.
ghcr.io/ryanmillard/img2num-devis hardcoded here and also constructed in.github/workflows/docker-ci.yml. If the repo/owner is ever renamed (or this is forked), both files must be kept in sync. Consider deriving fromgithub.repository_owner/github.event.repository.name(lowercased), e.g.:♻️ Suggested derivation
- name: Set image id: set run: | - if [[ "${{ github.event_name }}" == "pull_request" ]]; then - echo "image=ghcr.io/ryanmillard/img2num-dev:pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT - else - echo "image=ghcr.io/ryanmillard/img2num-dev:main" >> $GITHUB_OUTPUT - fi + OWNER="${GITHUB_REPOSITORY_OWNER,,}" + REPO="ghcr.io/${OWNER}/img2num-dev" + if [[ "${{ github.event_name }}" == "pull_request" ]]; then + echo "image=${REPO}:pr-${PR_NUMBER}" >> "$GITHUB_OUTPUT" + else + echo "image=${REPO}:main" >> "$GITHUB_OUTPUT" + fi + env: + PR_NUMBER: ${{ github.event.pull_request.number }}Also a minor hardening nit: moving
github.event.pull_request.numberintoenv:avoids GitHub Actions script-injection patterns, even though the PR number is numeric and safe in practice.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/ci.yml around lines 14 - 27, Replace the hardcoded image repo in the "Set image" step (step id "set", output "image") by deriving owner and repository from GitHub context: use github.repository_owner and github.event.repository.name (lowercased) to construct the image name instead of "ghcr.io/ryanmillard/img2num-dev"; also move github.event.pull_request.number into the step's env to reference it as an environment variable (avoids inline expression injection) so the step builds either "ghcr.io/<owner>/<repo-lowercase>:pr-<PR_NUMBER>" for pull requests or "ghcr.io/<owner>/<repo-lowercase>:main" otherwise.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 28-33: The reusable workflow wait-for-docker-image.yml currently
always queries Docker Hub and will never succeed for GHCR images; update the
workflow to detect the registry from IMAGE_NAME (look for prefixes like ghcr.io)
and branch: for Docker Hub keep the existing Docker Hub v2 tags curl using
IMAGE_NAME/TAG, and for GHCR implement the GHCR flow by first requesting an auth
token from https://ghcr.io/token?scope=repository:<name>:pull then calling
GHCR's manifest endpoint https://ghcr.io/v2/<name>/manifests/<tag> with that
Bearer token; ensure the variables IMAGE_NAME, TAG and retry loop governed by
MAX_ATTEMPTS are reused and that failures from the wrong-registry curl do not
exhaust attempts (i.e., choose the correct API based on registry prefix before
attempting requests).
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 14-27: Replace the hardcoded image repo in the "Set image" step
(step id "set", output "image") by deriving owner and repository from GitHub
context: use github.repository_owner and github.event.repository.name
(lowercased) to construct the image name instead of
"ghcr.io/ryanmillard/img2num-dev"; also move github.event.pull_request.number
into the step's env to reference it as an environment variable (avoids inline
expression injection) so the step builds either
"ghcr.io/<owner>/<repo-lowercase>:pr-<PR_NUMBER>" for pull requests or
"ghcr.io/<owner>/<repo-lowercase>:main" otherwise.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: a7b8a42c-924d-44d4-8253-a37e8804814f
📒 Files selected for processing (3)
.github/workflows/ci.yml.github/workflows/docker-ci.yml.github/workflows/wait-for-docker-image.yml
✅ Files skipped from review due to trivial changes (1)
- .github/workflows/wait-for-docker-image.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/docker-ci.yml
|
@coderabbitai, you said:
But the workflow pushes to the GHCR just fine with the current permissions and it appears in the package. What is the problem? |
|
Tip For best results, initiate chat on the files or code changes.
The original concern was about what happens when a contributor opens a PR from a fork of your repo — which is what this PR's objective states it is solving. For those: You can use the And more directly: Pull requests from public forks are still considered a special case and will receive a read token regardless of these settings. So in practice:
The workflow successfully pushes the
Would you like me to open a tracking issue for this, or does your repo not currently receive fork-based PRs and this was just a future-proofing concern? 🧠 Learnings used |
@coderabbitai, which job in |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 2363
My original concern about
So 🧠 Learnings used |
@coderabbitai, why did you say there was a problem then? |
|
Tip For best results, initiate chat on the files or code changes.
What I should have done is raise the concern directly on Sorry for the confusion — the original critical comment on 🧠 Learnings used |
@coderabbitai, does that mean that everything is okay for now because |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 5845
The So even though permissions:
packages: write
pull-requests: writeYou can use the In practical terms for
So the image never gets pushed, and The root issue is in
Would you like me to open a tracking issue for this? 🧠 Learnings used |
@coderabbitai, is there no way around this? I wanted to use GHCR to avoid the problem where secrets weren't allowed in fork workflows related to Docker Hub. |
|
Tip For best results, initiate chat on the files or code changes.
So the GHCR approach works perfectly for this PR (same-repo branch), but would hit the same wall as Docker Hub for a genuine fork contributor's PR. The proper workaround:
|
@coderabbitai, what if I do this before pushing: - name: Login to GHCR
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }} |
|
Tip For best results, initiate chat on the files or code changes.
Think of it like having a door key cut to only open the front door: logging in is inserting the key, but trying to push is opening a back-door lock your key was never cut for. The login action itself has no way to re-cut the key. So the sequence for a fork PR would be:
The 🧠 Learnings used |
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
14-45: Consider short-circuiting the probe onpushevents.On
pushtomain,github.event.pull_request.numberis empty, soPR_TAGbecomes"pr-"and both curls are guaranteed-to-404 round trips to GHCR and Docker Hub before falling through toMAIN_IMAGE. Harmless but wasteful, and if either registry ever rate-limits anonymous HEADs this could flap. Either:
- gate the job body on
if: github.event_name == 'pull_request'and skip the probe entirely for push (returning:maindirectly), or- check
[[ -z "${{ github.event.pull_request.number }}" ]]at the top of the script and short-circuit.Minor; not blocking.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/ci.yml around lines 14 - 45, The set-image job wastes network probes on non-PR events because PR_TAG is built from github.event.pull_request.number; modify the job to short-circuit for non-pull_request events by checking the event type or empty PR number at the top of the step: inside the step with id "set" (where MAIN_IMAGE, PR_TAG, GHCR_STATUS and DH_STATUS are defined) detect if github.event_name != 'pull_request' or PR number is empty and immediately emit MAIN_IMAGE to GITHUB_OUTPUT and exit, otherwise run the existing GHCR_STATUS/DH_STATUS probes; alternatively gate the entire job with if: github.event_name == 'pull_request' so the probes never run on push.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 23-45: The CI uses a single REPO var with the wrong Docker Hub
namespace ("ryan-millard/img2num-dev") causing the DH probe to fail and risking
drift; define separate repo variables (e.g.,
GHCR_REPO="ryan-millard/img2num-dev" and DH_REPO="ryanmillard/img2num-dev"),
keep PR_TAG and MAIN_IMAGE derived from the correct GHCR_REPO/GHCR image, build
DH_IMAGE and GHCR_IMAGE from their respective repo variables, and update the
curl checks (GHCR_STATUS and DH_STATUS) and the echo/GITHUB_OUTPUT lines to use
GHCR_IMAGE and DH_IMAGE so the Docker Hub probe queries the correct namespace
and names aren’t duplicated/hardcoded.
In @.github/workflows/docker-ci.yml:
- Around line 58-71: The awk usage on COMMENT_BODY captures field 2 from every
line, causing PROVIDED_SHA to contain trailing lines; change extraction to take
the second whitespace-separated token only from the first line of COMMENT_BODY
(so PROVIDED_SHA is derived from the first line/token), then validate
PROVIDED_SHA against a git-SHA hex regex (e.g. 7–40 hex chars) before
proceeding; update the logic around PROVIDED_SHA, COMMENT_BODY, CURRENT_SHA and
the subsequent [[ "$CURRENT_SHA" != "$PROVIDED_SHA"* ]] check to use the single
validated token and return the same user-facing error when validation fails.
- Around line 217-241: The GHCR deep-link includes the tag and will 404; update
the comment body to link to the package overview instead of a version-specific
path. In the comment body where you build the package URL using
steps.img.outputs.ghcr_image and env.CLEAN_CORE_TAG, remove the trailing "/${{
env.CLEAN_CORE_TAG }}" so the link points to https://github.com/${{
steps.img.outputs.lower_owner_name }}/${{ github.event.repository.name
}}/packages/container/img2num-dev (or, if you need a deep link, resolve the
numeric version via the Packages API and append ?tag=${{ env.CLEAN_CORE_TAG }}).
Ensure the markdown link and any references in the body (the one under "###
Image") use steps.img.outputs.lower_owner_name and steps.img.outputs.ghcr_image
accordingly.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 14-45: The set-image job wastes network probes on non-PR events
because PR_TAG is built from github.event.pull_request.number; modify the job to
short-circuit for non-pull_request events by checking the event type or empty PR
number at the top of the step: inside the step with id "set" (where MAIN_IMAGE,
PR_TAG, GHCR_STATUS and DH_STATUS are defined) detect if github.event_name !=
'pull_request' or PR number is empty and immediately emit MAIN_IMAGE to
GITHUB_OUTPUT and exit, otherwise run the existing GHCR_STATUS/DH_STATUS probes;
alternatively gate the entire job with if: github.event_name == 'pull_request'
so the probes never run on push.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 948c2c07-57a6-4978-9702-d41f632e7584
📒 Files selected for processing (2)
.github/workflows/ci.yml.github/workflows/docker-ci.yml
13b8e51 to
c0f3e29
Compare
|
/docker-build 13b8e51 |
c0f3e29 to
29ad493
Compare
29ad493 to
7d6dae9
Compare
|
@Krasner, please check this out. It first checks if the container registry has an image for this pr and defaults to For safety, we do not automatically push anything. Maintainers will need to run the build and push command. New commands for us to comment:
You can't see it work here because GitHub is stupid and the workflow file needs to be inside the base branch. I sent you a collaborator request for another repository. Please accept it and look at this PR: https://github.com/Ryan-Millard/Workflow-Tester/pull/31 The failures on it don't matter because they're unrelated. |
|
@Krasner, I also just updated it to only allow you and I to build and push the files (not other maintainers) for safety in the future because a future maintainer might not reason about the dangers of pushing an image without verifying what's going on. |
|
ok looks like this could work. we can try merging to main, updating my python branch, and then verifying that this works even for a PR coming from a fork |
Ryan-Millard
changed the title
main tag for CI and require maintainer sign-off on pushed builds
My fingers are about to break from how hard I have them crossed.😥 |
You got this! |
…ner sign-off on pushed builds (#312) * refactor(docker-ci): switch to use GitHub packages alongside Docker Hub (better PR integration) * ci(docker): fix notify job comment * ci(wait-for-docker-image.yml): fix check logic by including GHCR * ci(wait-for-docker-image): add default initial wait time & split into steps * fix(wait-for-docker-image): add ghcr & dh checks so it checks both registries * ci(docker-ci): fix prefix-collision bug in regex * ci(wait-for-docker-image): check GHCR push time to verify newness of build * test - don't worry, CodeRabbit * ci(docker): update docker-ci.yml to require commands to build and push image * fix(docker-ci): resolve code injection risk Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * ci(docker): cleanup docker-ci.yml * fix(docker-ci): accidental image name error * fix(docker-ci): Checkout of untrusted code in trusted context * ci(docker): restrict to only Krasner & Ryan-Millard with permission to build --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…ner sign-off on pushed builds (#312) * refactor(docker-ci): switch to use GitHub packages alongside Docker Hub (better PR integration) * ci(docker): fix notify job comment * ci(wait-for-docker-image.yml): fix check logic by including GHCR * ci(wait-for-docker-image): add default initial wait time & split into steps * fix(wait-for-docker-image): add ghcr & dh checks so it checks both registries * ci(docker-ci): fix prefix-collision bug in regex * ci(wait-for-docker-image): check GHCR push time to verify newness of build * test - don't worry, CodeRabbit * ci(docker): update docker-ci.yml to require commands to build and push image * fix(docker-ci): resolve code injection risk Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * ci(docker): cleanup docker-ci.yml * fix(docker-ci): accidental image name error * fix(docker-ci): Checkout of untrusted code in trusted context * ci(docker): restrict to only Krasner & Ryan-Millard with permission to build --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
|
/docker-cleanup |
…ner sign-off on pushed builds (#312) * refactor(docker-ci): switch to use GitHub packages alongside Docker Hub (better PR integration) * ci(docker): fix notify job comment * ci(wait-for-docker-image.yml): fix check logic by including GHCR * ci(wait-for-docker-image): add default initial wait time & split into steps * fix(wait-for-docker-image): add ghcr & dh checks so it checks both registries * ci(docker-ci): fix prefix-collision bug in regex * ci(wait-for-docker-image): check GHCR push time to verify newness of build * test - don't worry, CodeRabbit * ci(docker): update docker-ci.yml to require commands to build and push image * fix(docker-ci): resolve code injection risk Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * ci(docker): cleanup docker-ci.yml * fix(docker-ci): accidental image name error * fix(docker-ci): Checkout of untrusted code in trusted context * ci(docker): restrict to only Krasner & Ryan-Millard with permission to build --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
3 participants
What was changed & why
CI was changed to fix the build errors introduced in #310.
CI initially defaults to
:mainimage tag since the image for the PR won't have been pushed. Once a maintainer comments/docker-build <most-recent-commit-sha>or/docker-cleanup, things change.Fixes: none - my prior mistakes.
Changes
Just CI.
Testing & Verification
Additional Resources
Summary by CodeRabbit
Chores
New Features