ci: branch-tagged image builds via workflow_dispatch (insight#1994 Phase 1)

[cyberantonz]

Companion to constructorfabric/insight#2004 — Phase 1 of constructorfabric/insight#1994 (manual branch builds + image report).

What changes

• Branch-aware build tag: a workflow_dispatch from a non-main ref now produces ghcr.io/constructorfabric/insight-front:<YYYY.MM.DD.HH.MM>-<sha7>.<sanitized-branch> (same sanitization as the insight side: docker-tag charset, edge separators trimmed, 60-char cap). Main keeps the suffix-less format.
• The build tag is applied on every run: the only triggers are main pushes and workflow_dispatch, and a branch dispatch is a deliberate branch image build — previously it pushed only untagged digests (wasted work).
• latest stays default-branch-only (enable={{is_default_branch}}, unchanged).
• Step-summary report: the merge job writes the pushed ref to $GITHUB_STEP_SUMMARY.

What deliberately does not change

• dispatch-umbrella keeps its ref == main gate — a branch build never pins the frontend subchart appVersion in the umbrella chart.
• Main-push behavior is identical to today.

Usage

gh workflow run docker.yml --repo constructorfabric/insight-front --ref my-branch

or Actions → Docker Image → Run workflow → pick the branch (must live in this repo, not a fork).

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added branch-specific Docker image tags for builds from non-default branches.
  • Added the pushed image reference to the workflow run summary.

• Bug Fixes

  • Ensured build tags are applied consistently across all workflow runs.
  • Preserved the latest tag for default-branch builds only.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Docker workflow now creates branch-specific build tags, applies those tags to images from all runs, preserves default-branch-only latest tagging, and reports the pushed image reference in the workflow summary.

Changes

Docker image publishing

Layer / File(s)	Summary
Branch-aware build tag computation .github/workflows/docker.yml	Non-main branch names are sanitized and appended to the existing date and short-SHA build tag.
Image tagging and publication reporting .github/workflows/docker.yml	The computed build tag is applied on every run, while latest remains restricted to the default branch; the pushed image reference is added to the workflow summary.

Estimated code review effort: 3 (Moderate) | ~15–30 minutes

Possibly related issues

• constructorfabric/insight#1994 — Covers branch-tagged GHCR images and reporting the resulting image reference.

Suggested reviewers: aleksdotbar, artifizer, blackcelebrant

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: branch-tagged image builds triggered by workflow_dispatch.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (2)

.github/workflows/docker.yml (2)

159-168: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Update the stale workflow comments about branch pushes.

Non-main workflow_dispatch runs now publish a branch-suffixed build_tag, but later comments still say those runs push no image and describe every build as producing build_tag plus latest. Clarify that branch runs publish only their computed tag, while latest remains default-branch-only.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker.yml around lines 159 - 168, The comments
surrounding the Docker image tag configuration are stale. Update the later
workflow comments to state that non-main workflow_dispatch runs publish only
their computed branch-suffixed build_tag, while default-branch runs may also
publish latest; remove claims that branch runs publish no image or that every
build produces both tags.

---

177-180: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Pass the image reference through env instead of interpolating it into shell source.

The current sanitizer makes this value safe today, but direct template expansion in run is the injection pattern reported by zizmor. Use an environment variable so the shell never parses the computed output as code.

Proposed fix

       - name: Report pushed image
+        env:
+          IMAGE_REF: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.prepare.outputs.build_tag }}
         run: |
-          echo '- `${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.prepare.outputs.build_tag }}`' >> "$GITHUB_STEP_SUMMARY"
+          printf '%s\n' "- \`${IMAGE_REF}\`" >> "$GITHUB_STEP_SUMMARY"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker.yml around lines 177 - 180, Update the “Report
pushed image” workflow step to pass the computed image reference through the
step’s env configuration, then have the run script append that environment
variable to GITHUB_STEP_SUMMARY. Remove direct GitHub expression interpolation
of the image value from shell source while preserving the existing summary
format.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/docker.yml:
- Around line 159-168: The comments surrounding the Docker image tag
configuration are stale. Update the later workflow comments to state that
non-main workflow_dispatch runs publish only their computed branch-suffixed
build_tag, while default-branch runs may also publish latest; remove claims that
branch runs publish no image or that every build produces both tags.
- Around line 177-180: Update the “Report pushed image” workflow step to pass
the computed image reference through the step’s env configuration, then have the
run script append that environment variable to GITHUB_STEP_SUMMARY. Remove
direct GitHub expression interpolation of the image value from shell source
while preserving the existing summary format.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e9594429-aeef-4d53-963c-9e8b36d431f3

📥 Commits

Reviewing files that changed from the base of the PR and between f6bd345 and e1a6ba6.

📒 Files selected for processing (1)

• .github/workflows/docker.yml