Skip to content

ci: build docker image on PRs / tags #2353

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tac0turtle merged 2 commits into from
Jun 9, 2025
+37 −20
Merged

ci: build docker image on PRs / tags #2353

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5fce62d
chore: updating tag format to handle PRs as well as tags
chatton Jun 9, 2025
3b24ece
chore: fixed casing in name
chatton Jun 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/ci_release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,9 @@ jobs:
test:
uses: ./.github/workflows/test.yml
secrets: inherit
with:
# tag with the pr in the format of pr-1234 or the tag / branch if it is not a PR.
image-tag: ${{ github.event.pull_request.number && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}

proto:
uses: ./.github/workflows/proto.yml
Expand Down
20 changes: 0 additions & 20 deletions .github/workflows/docker-build-publish.yml
View file
Open in desktop

This file was deleted.

34 changes: 34 additions & 0 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,42 @@
name: Tests / Code Coverage
on:
workflow_call:
inputs:
image-tag:
required: true
type: string

jobs:
build-docker-image:
name: Build Docker Image
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow

Unpinned 3rd party Action 'Tests / Code Coverage' step [Uses Step](1) uses 'docker/setup-buildx-action' with ref 'v3', not a pinned commit hash

- name: Log in to GHCR
uses: docker/login-action@v3

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow

Unpinned 3rd party Action 'Tests / Code Coverage' step [Uses Step](1) uses 'docker/login-action' with ref 'v3', not a pinned commit hash
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Build and push Docker image with PR tag
uses: docker/build-push-action@v5

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow

Unpinned 3rd party Action 'Tests / Code Coverage' step [Uses Step](1) uses 'docker/build-push-action' with ref 'v5', not a pinned commit hash
with:
context: .
push: true
tags: ghcr.io/${{ github.repository_owner }}/rollkit:${{ inputs.image-tag }}

upgrade-tests:
Comment on lines +13 to +36

Check warning

Code scanning / CodeQL

Workflow does not contain permissions

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{contents: read}}

Copilot Autofix

AI about 1 year ago

To fix the issue, we need to add a permissions block to the workflow. This block should specify the least privileges required for the workflow to function correctly. Based on the steps in the workflow:

  • The docker/login-action step requires contents: read to authenticate using the GITHUB_TOKEN.
  • Other steps in the workflow do not appear to require additional permissions.

The permissions block should be added at the root level of the workflow to apply to all jobs, as none of the jobs require write permissions.

Suggested changeset 1
.github/workflows/test.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -3,2 +3,4 @@
 name: Tests / Code Coverage
+permissions:
+  contents: read
 on:
EOF
@@ -3,2 +3,4 @@
name: Tests / Code Coverage
permissions:
contents: read
on:
Copilot is powered by AI and may make mistakes. Always verify output.
Comment on lines +13 to +36

@coderabbitai coderabbitai Bot Jun 9, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Add explicit permissions block for least-privilege
This workflow currently inherits default token permissions, which may be overly permissive. Define a top-level permissions: block (e.g., contents: read, packages: write) to restrict GITHUB_TOKEN to only the scopes needed for build and push operations.

🧰 Tools
🪛 GitHub Check: CodeQL

[warning] 13-36: Workflow does not contain permissions
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{contents: read}}

[warning] 20-20: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/setup-buildx-action' with ref 'v3', not a pinned commit hash

[warning] 23-23: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/login-action' with ref 'v3', not a pinned commit hash

[warning] 30-30: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/build-push-action' with ref 'v5', not a pinned commit hash

🤖 Prompt for AI Agents 
In .github/workflows/test.yml around lines 13 to 36, the workflow lacks an
explicit permissions block, causing the GITHUB_TOKEN to have default,
potentially excessive permissions. Add a top-level permissions section
specifying only the necessary scopes, such as 'contents: read' and 'packages:
write', to enforce least-privilege access for the build and push steps.

needs: build-docker-image
runs-on: ubuntu-latest
steps:
- run: exit 0 # TODO: add upgrade test uses the image built in the build-docker-image step

build_all-apps:
name: Build All Rollkit Binaries
runs-on: ubuntu-latest
Expand Down