workflows: various small fixes

.github/workflows/build-images-ci.yaml

@@ -177,8 +177,9 @@ jobs:
   # we need to build cilium-test separately
   # this is caused by running apt while building the image
   # which requires qemu setup in order to avoid x86/arm64 binaries mixups
+  # note: we only build on pushes to master branch
   build-and-push-with-qemu:
-    if: ${{ github.repository == 'cilium/cilium' }}
+    if: ${{ github.repository == 'cilium/cilium' && github.event_name == 'push' }}
     runs-on: ubuntu-20.04
     strategy:
       matrix:
@@ -200,24 +201,13 @@ jobs:
           username: ${{ secrets.QUAY_USERNAME_CI }}
           password: ${{ secrets.QUAY_PASSWORD_CI }}
 
-      - name: Getting image tag
-        id: tag
-        run: |
-          if [ ${{ github.event.pull_request.head.sha }} != "" ]; then
-            echo ::set-output name=tag::${{ github.event.pull_request.head.sha }}
-          else
-            echo ::set-output name=tag::${{ github.sha }}
-          fi
-
       - name: Checkout Source Code
         uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
         with:
           persist-credentials: false
-          ref: ${{ steps.tag.outputs.tag }}
+          ref: ${{ github.sha }}
 
-      # master branch pushes
       - name: CI Build ${{ matrix.name }}
-        if: ${{ github.event_name != 'pull_request_target' }}
         uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
         id: docker_build_ci_master
         with:
@@ -227,15 +217,14 @@ jobs:
           platforms: linux/amd64,linux/arm64
           tags: |
             quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:latest
-            quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:${{ steps.tag.outputs.tag }}
+            quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:${{ github.sha }}
 
       - name: CI Image Releases digests
-        if: ${{ github.event_name != 'pull_request_target' }}
         shell: bash
         run: |
           mkdir -p image-digest/
           echo "quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:latest@${{ steps.docker_build_ci_master.outputs.digest }}" > image-digest/${{ matrix.name }}.txt
-          echo "quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:${{ steps.tag.outputs.tag }}@${{ steps.docker_build_ci_master.outputs.digest }}" >> image-digest/${{ matrix.name }}.txt
+          echo "quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:${{ github.sha }}@${{ steps.docker_build_ci_master.outputs.digest }}" >> image-digest/${{ matrix.name }}.txt
 
       # Upload artifact digests
       - name: Upload artifact digests

.github/workflows/lint-bpf-checks.yaml

@@ -23,7 +23,6 @@ jobs:
         uses: dorny/paths-filter@78ab00f87740f82aec8ed8826eb4c3c851044126
         id: changes
         with:
-          base: ${{ github.event.pull_request.base.sha || github.event.before }}
           filters: |
             bpf-tree:
               - 'bpf/**'

.github/workflows/lint-build-commits.yaml

@@ -22,32 +22,32 @@ jobs:
         uses: actions/setup-go@37335c7bb261b353407cff977110895fa0b4f7d8
         with:
           go-version: 1.16.4
-          
+
       - name: Cache LLVM and Clang
         id: cache-llvm
         uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353
         with:
           path: $HOME/.clang
           key: llvm-10.0
-          
+
       - name: Install LLVM and Clang
         uses: KyleMayes/install-llvm-action@d0970114d0f720f5eb6a91b9e33cc2699f469f37
         with:
           version: "10.0"
           directory: $HOME/.clang
           cached: ${{ steps.cache-llvm.outputs.cache-hit }}
-          
+
       - name: Install libelf
         run: |
           sudo apt-get install libelf-dev
-          
+
       - name: Checkout code
         uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
         with:
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
-          
+
       - name: Check if build works for every commit
         run: |
           PR_COMMITS_API_JSON=$(curl \
@@ -62,7 +62,6 @@ jobs:
         uses: dorny/paths-filter@78ab00f87740f82aec8ed8826eb4c3c851044126
         id: bpf-tree
         with:
-          base: ${{ github.event.pull_request.base.sha }}
           filters: |
             src:
               - 'bpf/**'
@@ -78,11 +77,11 @@ jobs:
           PR_FIRST_SHA=$(echo "$PR_COMMITS_API_JSON" | jq -r ".[0].sha")
           PR_PARENT_SHA=$(git rev-parse "${PR_FIRST_SHA}^")
           git rebase --exec "make -C bpf build_all -j $(nproc)" $PR_PARENT_SHA
-        
+
       - name: Failed commit during the build
         if: ${{ failure() }}
         run: git --no-pager log --format=%B -n 1
-        
+
       - name: Send slack notification
         if: ${{ (cancelled() || failure()) && (github.event_name == 'schedule' || github.event_name == 'push') }}
         uses: 8398a7/action-slack@dcc8c8e9dd8802e21a712dc0c003db97b42efe43