v1.0.2

Fixed

• Render identical before/after image transitions once, retaining every affected file, Compose service, and Dockerfile stage.
• Keep transitions with different source or destination references separate and deduplicate repeated notices within a shared comparison.

Maintenance

• Configure Renovate for npm dependencies and GitHub Actions.
• Document grouped comparisons and the trusted bundle-rebuild workflow for dependency PRs.

Verified with 40 passing tests, lint, a reproducible bundle build, and a live comparison of the exact image digests from PlatformAPI #449. Docker Hub rate-limited the workstation; the live metadata check used Google's Docker Hub cache without changing production registry behavior.

CI: https://github.com/TechnicPack/docker-image-diff/actions/runs/35394439771

v1.0.1 — MIT license and usage documentation

Changes

• Add the MIT license, attributed to Syndicate LLC consistently with TechnicSolder, and declare it in package metadata.
• Add a README covering installation, token permissions, inputs/outputs, supported files, digest requirements, security boundaries, and development.
• Explain that publisher metadata can be coarse (for example, 24-alpine) and that unpinned tags cannot identify historical image contents.
• No changes to action runtime behavior.

Verification

• 38 regression tests, lint, bundle rebuild, and Node24 CI passed.
• The README workflow and repository workflow examples passed actionlint; the README was rendered through GitHub Markdown.
• Tested production discovery and registry-comparison code against local PlatformAPI files: four definition files, four distinct pinned images (Node, MariaDB, Redis, OpenSearch), and four historical image-reference changes. The report identified MariaDB 12.3.2 → 12.3.3 and Redis 8.10.0 → 8.10.1. Interpolated production image references were explicitly skipped.
• Tested local TechnicSolder files: three definition files and eight literal references. Its historical Node 24.18.1-slim → 24.20.0-slim update was reported without guessing platform metadata, because neither reference has a digest pin.
• Neither consuming repository nor its pull requests was modified.

Usage

Copy examples/renovate.yml, or follow the README.

TechnicPack/docker-image-diff@v1 now points to this release. The immutable action reference is:

- uses: TechnicPack/docker-image-diff@a4b8adf7839c0c9ce110d235f771ffdc0b1fab05 # v1.0.1

v1.0.0 — Docker image comparisons

Reusable Node.js 24 GitHub Action for describing Docker image changes in pull requests.

Usage

Copy examples/renovate.yml into .github/workflows/docker-image-diff.yml in a consuming repository. The example filters Renovate PRs; change or remove the author filter for other bots or human PRs.

For immutable action code, use:

- uses: TechnicPack/docker-image-diff@fc571f5466db94d59df68fafb9446f71b90939f0 # v1.0.0

The convenience tags v1.0.0 and v1 are also available. Requires a Node24-compatible runner with Docker CLI and Buildx; ubuntu-latest supplies them. No checkout, personal access token, image build, or container execution is needed.

Behavior

• Reads Compose service image fields and Dockerfile FROM instructions via GitHub APIs at immutable revisions.
• Compares SHA256-pinned images, with per-platform versions, image digests, base-image metadata, and source revisions where published.
• Supports multi-platform indexes, nested indexes, single-platform manifests, annotation/label fallback, and attestation exclusion.
• Creates one maintained PR comment and updates it after new commits. Keeps per-PR concurrency in the caller and rejects stale-head publication.
• Missing labels remain unknown; moving tags are not used to guess historical versions.

Inputs and outputs

Input	Default	Purpose
github-token	${{ github.token }}	Token with contents read and pull-requests write permissions
allowed-registries	docker.io,ghcr.io,quay.io	Comma/newline-separated exact permitted registry hosts
comment	true	Set false for a read-only job summary
max-images	30	Unique pinned-image limit, 1–100

Outputs: changes, comment-url, and Markdown report.

Security and limitations

• Never check out or execute PR code in the privileged pull_request_target caller. The action treats PR content and registry metadata as untrusted data.
• Publisher markup and mentions are neutralized; image references remain copyable.
• Registry lookups use shell-free process arguments, exact host restrictions, and bounded time/output/index traversal. Docker-managed auth/CDN redirects and configured mirrors are outside the image-host allowlist.
• Private registries require explicit trusted login setup before the action and an approved host. Do not forward unrelated secrets.
• ARG/environment interpolation is not evaluated. Unsupported heredocs, escape directives, malformed files, and unreadable content are reported instead of guessed. Supported files are Compose YAML and Dockerfiles, not arbitrary Kubernetes/Helm files.
• Versions are publisher-supplied metadata, not values obtained by executing a database/server binary.

Verification

38 deterministic regression tests; lint, workflow validation, and Node24 CI; real registry and PlatformAPI #461 comparisons. End-to-end verification PR demonstrates the published comment.