v1.0.0 — Docker image comparisons

Reusable Node.js 24 GitHub Action for describing Docker image changes in pull requests.

Usage

Copy examples/renovate.yml into .github/workflows/docker-image-diff.yml in a consuming repository. The example filters Renovate PRs; change or remove the author filter for other bots or human PRs.

For immutable action code, use:

- uses: TechnicPack/docker-image-diff@fc571f5466db94d59df68fafb9446f71b90939f0 # v1.0.0

The convenience tags v1.0.0 and v1 are also available. Requires a Node24-compatible runner with Docker CLI and Buildx; ubuntu-latest supplies them. No checkout, personal access token, image build, or container execution is needed.

Behavior

• Reads Compose service image fields and Dockerfile FROM instructions via GitHub APIs at immutable revisions.
• Compares SHA256-pinned images, with per-platform versions, image digests, base-image metadata, and source revisions where published.
• Supports multi-platform indexes, nested indexes, single-platform manifests, annotation/label fallback, and attestation exclusion.
• Creates one maintained PR comment and updates it after new commits. Keeps per-PR concurrency in the caller and rejects stale-head publication.
• Missing labels remain unknown; moving tags are not used to guess historical versions.

Inputs and outputs

Input	Default	Purpose
github-token	${{ github.token }}	Token with contents read and pull-requests write permissions
allowed-registries	docker.io,ghcr.io,quay.io	Comma/newline-separated exact permitted registry hosts
comment	true	Set false for a read-only job summary
max-images	30	Unique pinned-image limit, 1–100

Outputs: changes, comment-url, and Markdown report.

Security and limitations

• Never check out or execute PR code in the privileged pull_request_target caller. The action treats PR content and registry metadata as untrusted data.
• Publisher markup and mentions are neutralized; image references remain copyable.
• Registry lookups use shell-free process arguments, exact host restrictions, and bounded time/output/index traversal. Docker-managed auth/CDN redirects and configured mirrors are outside the image-host allowlist.
• Private registries require explicit trusted login setup before the action and an approved host. Do not forward unrelated secrets.
• ARG/environment interpolation is not evaluated. Unsupported heredocs, escape directives, malformed files, and unreadable content are reported instead of guessed. Supported files are Compose YAML and Dockerfiles, not arbitrary Kubernetes/Helm files.
• Versions are publisher-supplied metadata, not values obtained by executing a database/server binary.

Verification

38 deterministic regression tests; lint, workflow validation, and Node24 CI; real registry and PlatformAPI #461 comparisons. End-to-end verification PR demonstrates the published comment.