ci: auto-regenerate Dockerfiles on PRs#114
Merged
Merged
Conversation
Adds two GitHub Actions workflows that react when a PR changes docker/snippets/, docker/images.json, or docker/generate-dockerfiles.ps1: * regen-dockerfiles-push.yml — same-repo PRs only. Regenerates the Dockerfiles and pushes the result back to the PR branch. Permission scope: `contents: write`. * regen-dockerfiles-comment.yml — fork PRs only. Runs the base branch's trusted generator against the head's snippet data (never executes head code), detects drift, and posts a comment telling the contributor what to run. Refuses entirely if the PR modifies generate-dockerfiles.ps1. Permission scope: `contents: read` + `pull-requests: write`. The existing verify-generated-dockerfiles job in publish.yml stays as the hard CI gate — these workflows are the auto-fixer / nudge layered on top, so PRs like #112 (golang bump without regen) self-heal instead of needing a maintainer to push the regen commit manually. Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: GitButler <gitbutler@gitbutler.com>
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 648a92e72a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Contributor
There was a problem hiding this comment.
Pull request overview
Adds PR-time automation to keep docker/generated/* aligned with docker/snippets/** and docker/images.json, reducing maintainer intervention when contributors forget to run the generator.
Changes:
- Introduces a same-repo PR workflow that regenerates Dockerfiles and pushes the result back to the PR branch.
- Introduces a fork-safe PR workflow that regenerates using the base branch generator + head branch snippet data and comments when drift is detected (or skips when the generator script is modified).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| .github/workflows/regen-dockerfiles-push.yml | Regenerates docker/generated/* for same-repo PRs and pushes a regen commit back to the PR branch. |
| .github/workflows/regen-dockerfiles-comment.yml | For fork PRs, runs a trusted regeneration using base generator + PR data and posts a comment when generated Dockerfiles drift. |
Address PR review feedback from Codex and Copilot: * git diff --quiet ignored untracked files, so a new image entry in images.json would generate a brand-new docker/generated/Dockerfile.* that the drift check would miss — "No drift" would fire, the new file would never get committed (push workflow) or surfaced (comment workflow), and the existing verify-generated-dockerfiles job would fail without explanation. Switch both workflows to `git status --porcelain -- docker/generated`, which catches modified, deleted, and untracked entries in one shot. The comment workflow also appends a "Untracked new generated files" section to the diff stat so contributors see exactly what's new. * The fork-comment workflow posted a fresh PR comment on every synchronize event, which would spam long-running PRs. Introduce .github/scripts/sticky-pr-comment.sh — a 30-line helper that finds a prior bot comment by HTML marker and PATCHes it in place, creating a new one only when none exists. Both comment paths (drift and generator-changed) now use it with the same marker so the same comment is recycled. Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: GitButler <gitbutler@gitbutler.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds two GitHub Actions workflows that react when a PR changes Dockerfile-generator inputs, so PRs like #112 (Go version bump without running the regen script) self-heal instead of needing a maintainer to push the regen commit manually.
regen-dockerfiles-push.yml— same-repo PRs only. Regeneratesdocker/generated/*and pushes the result back to the PR branch. Scope:contents: write.regen-dockerfiles-comment.yml— fork PRs only. Runs the base branch's trusted generator against the head's snippet data (never executes head code), detects drift, and posts a comment telling the contributor what to run. Refuses entirely if the PR modifiesgenerate-dockerfiles.ps1itself. Scope:contents: read+pull-requests: write.The existing
verify-generated-dockerfilesjob inpublish.ymlstays as the hard CI gate.Permissions
Every job declares the minimum scope it needs. No
read-all, no secrets exposure beyondGITHUB_TOKEN. Top-levelpermissions: {}.Trust model (fork comment workflow)
docker/snippets/**anddocker/images.jsonfrom the head are copied as inputs to the base's trusted generator.docker/generate-dockerfiles.ps1, the workflow skips the regen and posts a "manual review needed" comment.Invoke-Expression, no eval of snippet content.Test plan
docker/snippets/golang.Dockerfile) without running the generator. Workflow should push a regen commit within a minute.README.mdtriggers neither workflow.generate-dockerfiles.ps1→ "skipped for safety" comment.