feat: GitHub Action with sticky PR summary comment by PunGrumpy · Pull Request #38 · PunGrumpy/docker-doctor

PunGrumpy · 2026-08-10T13:03:01Z

Summary

Adds a composite GitHub Action (PunGrumpy/docker-doctor@v0) so any repo can scan Dockerfiles/Compose files on every PR and get a sticky summary comment.

action.yml (repo root) — sets up Node, runs npx @docker-doctor/cli --json into a report file, renders, comments, and enforces the gate. Inputs: directory, version, blocking (none/warning/error, advisory by default), comment, config. Outputs: score, label, per-severity counts. Third-party actions are SHA-pinned.
scripts/render-github-action-comment.mjs — report → comment: intro line, per-file status table (File / Status / Issues / Updated (UTC)) with SVG status dots sorted worst-first, overflow rows collapsed past 20, a score line linking to the share page, and all findings in one <details> that auto-expands when errors exist. Marker first line for upsert; mirrors to job summary; crash-safe. Dots next to a text label carry empty alt so screen readers don't announce the severity twice.
Status dot SVGs served from the site at /status/*.svg — severity dots (error #ee0000, warning #dfb317, info #0969da, clean #4c1) plus score-bucket dots matching the badge palette. They render once the web app deploys to production (after merge).
Gate semantics — exit code deferred to the last step; only pull_request events can fail, pushes are always advisory.
Versioning — lockstep with the CLI via changesets: release.yml moves an exact v<version> tag plus a floating major (v0, later v1) on every publish. Docs and the wizard scaffold reference @v0; no manual tagging needed.
Docs — new /docs/guides/github-actions page (quick start, what the comment shows + live example link, inputs, outputs, gating, versioning); the README CI section is a two-line pointer to it. The CLI's post-scan wizard now scaffolds the action-based workflow (it previously wrote a broken bunx docker-doctor one).
Landing page — new section between the terminal demo and the architecture tour: a hand-built PR-comment mock (bot header, Dockerfile diff rows, no-secrets-in-env finding) drawn at 740×357 and scaled to the container via container-query units, so it fits every viewport without horizontal scrolling.
Dogfood workflow scans packages/docker-doctor/test/fixtures/with-error on every PR — the sticky comment on this PR is the live end-to-end test.

Test plan

Renderer run locally against 5 report shapes (multi-file with mixed severities, error fixture, info-only, no Docker files, corrupted JSON) — comment body, step outputs, and gate status verified for each; the deslop pass was verified byte-identical against a baseline
Landing section and docs page verified rendered (light + dark, desktop + 390px) via the browser preview; the See docs link keeps a ≥24px hit area at mobile scale
Interface review (interface-review → better-interface, full mode): 2 MEDIUM + 2 LOW findings, all fixed — verdict Approve
bun x ultracite check clean; pre-commit build/tests/typecheck pass; all PR checks green
Dogfood workflow on this PR exercised both the comment-create and comment-update paths

After merge

Merge the changesets "Version Packages" PR → npm publishes 0.3.2, release.yml pushes tags v0.3.2 + v0, Vercel deploys the status dot SVGs and the new pages
Follow-ups deliberately deferred: commit status with score, inline review comments, toolchain caching, GitHub Marketplace listing

🤖 Generated with Claude Code

Runs @docker-doctor/cli --json, renders the report into a marker-based sticky comment (errors expanded, warnings/info collapsed), mirrors it to the job summary, and enforces an advisory-by-default gate (blocking: none | warning | error) that only ever fails pull requests. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vercel · 2026-08-10T13:03:07Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docker-doctor	Ready	Preview	Aug 10, 2026 3:41pm

github-actions · 2026-08-10T13:03:18Z

The latest Docker Doctor scan for this pull request. Learn more about Docker Doctor.

File	Status	Issues	Updated (UTC)
`Dockerfile`	Error	1 error, 2 info	Aug 10, 2026 3:41pm

Score: 84 / 100 · Good

3 issues

Dockerfile

Dockerfile:2 Potential secret found in ENV: 'DB_PASSWORD'. no-secrets-in-env
Dockerfile:1 No HEALTHCHECK instruction found. require-healthcheck
Dockerfile:1 No LABEL metadata was found in this Dockerfile. require-labels

_{Scanned by Docker Doctor for commit 6fefaa9.}

Per-file rows (File / Status / Issues / Updated) with colored status dots, worst-severity-first ordering, an overflow <details> past 20 rows, and all findings in one collapsible section that auto-expands when errors exist. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Same approach as Vercel's bot comments (vercel.com/static/status/ready.svg): 10x10 circle SVGs served from the site, colored to match the badge palette. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

**Score:** 84 / 100 · [dot] Good — same dot+word pattern as the table's Status column, with per-bucket dots matching the badge palette. The CLI label's emoji is stripped for the comment. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- fileRow tracks the worst severity by name instead of reverse-mapping a rank number through SEVERITY_RANK - one groupByFile helper replaces the two hand-rolled Map-building loops - one stepOutputs helper replaces the duplicated output shapes in renderFailure and renderReport - renderReport counts severities instead of keeping filtered arrays it only ever measured Rendered output verified byte-identical across all five report shapes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Same /share?s=&w=&e= URL the CLI prints after a terminal scan. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The pending patch changeset makes the next release 0.3.2, and release.yml now pushes v<version> automatically — no manual v0.3.1 tag needed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ction The README now links to /docs/guides/github-actions (quick start, inputs, outputs, gating, versioning) instead of inlining the workflow, matching how the rest of the CLI surface is documented. Reword the changeset. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The wizard previously wrote a workflow invoking 'bunx docker-doctor' — an npm package that does not exist — with no permissions and no PR comment. It now writes the docs quick-start workflow using the GitHub Action, pinned to the CLI's own version (the lockstep tag always exists). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Each publish now moves two tags: the exact v<version> for reproducible pins and a floating major (v0, later v1) that tracks the latest release. Docs and the wizard scaffold reference the floating tag so consumers pick up action fixes without editing their workflows. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The status dots are served from the same site, so the docs can render the comment's table, score line, and findings natively instead of a screenshot. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- Status dots next to a text label get empty alt so screen readers stop announcing the severity twice; finding-line dots keep their alt as the sole severity cue (comment renderer + docs mock) - The docs job-summary note now says a push trigger is needed for push-run summaries instead of implying the pull_request-only quick start produces them - Docs mock links point at the live example comment on PR #38 instead of a self-referencing anchor - Wizard success copy no longer zeugmas ('gets a scan and a sticky summary comment') Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Match react.doctor's approach: a short list of what the comment contains plus a link to a live example PR, rather than a rendered replica that has to track the real design. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

A hand-built mock of the PR comment — bot header, per-file status rows, score line, one finding with its rule chip — framed like the other landing cards, with a footer link to the live example on PR #38. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

github-actions · 2026-08-10T14:49:59Z

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 6fefaa9.}

The mock stays drawn at a fixed 740x357 and scales to the container width via container-query units (tan(atan2()) divides the two lengths into a plain ratio), so no horizontal scrolling at any viewport. The See docs link gets an expanded hit area to stay tappable when scaled. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

@container

Use the @container and aspect-740/357 shorthands, the scale-[...] utility, shadow-border in place of explicit border declarations, and from-85% without brackets. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Drop the gradient overlay (it doubled the card's shadow-border ring) and the card background, leaving the shadow-border rings to carry the structure in both appearances. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

PunGrumpy and others added 3 commits August 10, 2026 20:01

ci: dogfood the Docker Doctor action on every PR

3823cd7

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs(readme): document the GitHub Action usage

4f69cb4

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vercel Bot deployed to Preview August 10, 2026 13:03 View deployment

PunGrumpy and others added 3 commits August 10, 2026 20:11

ci(release): tag the action v<version> on each changeset publish

78ff587

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs(readme): version the action in lockstep with the CLI (v0.3.1)

7818fe0

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vercel Bot deployed to Preview August 10, 2026 13:12 View deployment

refactor(action): include the year in the comment's Updated column

f821e87

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vercel Bot deployed to Preview August 10, 2026 13:17 View deployment

PunGrumpy and others added 2 commits August 10, 2026 20:24

feat(web): add status dot SVGs for the action's PR comment

c016bb4

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

refactor(action): use hosted SVG status dots instead of emoji

ebb7dab

Same approach as Vercel's bot comments (vercel.com/static/status/ready.svg): 10x10 circle SVGs served from the site, colored to match the badge palette. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vercel Bot deployed to Preview August 10, 2026 13:26 View deployment

refactor(web): serve status dots from /status instead of /static/status

68bf282

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vercel Bot deployed to Preview August 10, 2026 13:35 View deployment

refactor(web): use Vercel's vivid red (#ee0000) for the error status dot

b2b156d

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vercel Bot deployed to Preview August 10, 2026 13:37 View deployment

vercel Bot deployed to Preview August 10, 2026 13:46 View deployment

vercel Bot deployed to Preview August 10, 2026 13:50 View deployment

feat(action): link the comment's score to the share page

80efed1

Same /share?s=&w=&e= URL the CLI prints after a terminal scan. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vercel Bot deployed to Preview August 10, 2026 13:54 View deployment

docs(readme): point the action at v0.3.2, the tag the next release cuts

30d8cac

The pending patch changeset makes the next release 0.3.2, and release.yml now pushes v<version> automatically — no manual v0.3.1 tag needed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vercel Bot deployed to Preview August 10, 2026 14:02 View deployment

vercel Bot deployed to Preview August 10, 2026 14:06 View deployment

vercel Bot deployed to Preview August 10, 2026 14:11 View deployment

vercel Bot deployed to Preview August 10, 2026 14:15 View deployment

docs(web): render a live mock of the PR comment in the Actions guide

feb6a4d

The status dots are served from the same site, so the docs can render the comment's table, score line, and findings natively instead of a screenshot. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vercel Bot deployed to Preview August 10, 2026 14:25 View deployment

vercel Bot deployed to Preview August 10, 2026 14:34 View deployment

docs(web): describe the PR comment instead of mocking it

17351ca

Match react.doctor's approach: a short list of what the comment contains plus a link to a live example PR, rather than a rendered replica that has to track the real design. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vercel Bot deployed to Preview August 10, 2026 14:39 View deployment

vercel Bot deployed to Preview August 10, 2026 14:50 View deployment

vercel Bot deployed to Preview August 10, 2026 15:08 View deployment

vercel Bot temporarily deployed to Preview August 10, 2026 15:16 Inactive

refactor(web): tidy the action mock's Tailwind idiom

60a50e0

Use the @container and aspect-740/357 shorthands, the scale-[...] utility, shadow-border in place of explicit border declarations, and from-85% without brackets. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

PunGrumpy force-pushed the feat/github-action branch from 3a1ffc5 to 60a50e0 Compare August 10, 2026 15:18

vercel Bot deployed to Preview August 10, 2026 15:19 View deployment

refactor(web): flatten the action mock card

b205467

Drop the gradient overlay (it doubled the card's shadow-border ring) and the card background, leaving the shadow-border rings to carry the structure in both appearances. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vercel Bot deployed to Preview August 10, 2026 15:27 View deployment

refactor(web): change rounded from lg to xl

6fefaa9

vercel Bot deployed to Preview August 10, 2026 15:41 View deployment

PunGrumpy merged commit 1d838c6 into main Aug 10, 2026
10 checks passed

PunGrumpy deleted the feat/github-action branch August 10, 2026 15:50

Navigation Menu

Uh oh!

feat: GitHub Action with sticky PR summary comment - #38

feat: GitHub Action with sticky PR summary comment#38
PunGrumpy merged 26 commits into
mainfrom
feat/github-action

PunGrumpy commented Aug 10, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

PunGrumpy commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

After merge

Uh oh!

vercel Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

PunGrumpy commented Aug 10, 2026 •

edited

Loading

vercel Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading