v1.0.2

Warning

Behaviour change despite the patch version. An unset cache_from or cache_to no
longer selects a registry cache — it now means no cache. If a build_and_push call in
your repo omits either input, set it explicitly before taking this bump, or that build
silently loses its cache and stops refreshing its :cache tag.

Changed

build_and_push used to substitute a default whenever a cache input was unset:

cache_from = type=registry,ref=$REGISTRY/$IMAGE:cache
cache_to   = type=registry,ref=$REGISTRY/$IMAGE:cache,mode=max

That made "no cache" inexpressible (empty selected the default, and a composite action
cannot tell "unset" from "explicitly empty"), pushed a :cache tag as a side effect of an
input nobody set, and made this wrapper behave differently from the docker/build-push-action
it wraps.

Both inputs are now passed straight through. docker/build-push-action parses them as
newline-separated lists and emits no --cache-from / --cache-to flag for an empty value,
so caching is opt-in and the wrapper matches the action it wraps.

The Set cache values step is gone entirely (−32 lines), taking the $GITHUB_OUTPUT
round-trip and six template interpolations with it.

Are you affected?

Only if a build_and_push call omits cache_from or cache_to. Callers that already pass
both are unaffected.

cache_from: type=registry,ref=${{ env.registry }}/my-image:cache
cache_to: type=registry,ref=${{ env.registry }}/my-image:cache,mode=max

Or leave them unset deliberately — worth doing on release builds, where an exported cache is
usually written and never read.

Pin to this release

uses: pubky/ci-workflows/.github/actions/docker/build_and_push@5faaf004d36bb93a204b58cf7190ffe7fbcce16f # v1.0.2

Reference the commit SHA, not @v1.0.2 and not @main.

v1.0.1

Patch release. Drop-in for v1.0.0 — no input or output changes.

Fixed

build_and_push wrote its cache outputs as name=value, which breaks GitHub Actions
output parsing when cache_from or cache_to contains multiple lines — the documented
way to pass more than one cache source. The build silently used only the first line.
Now written as multiline output blocks with a collision-checked delimiter.

Thanks to @andrei-21 (#5).

Pin to this release

uses: pubky/ci-workflows/.github/actions/docker/build_and_push@__fb57f8b93748b593adfce2cd722d788e3d3bf81d__ # v1.0.1
Reference the commit fb57f8b93748b593adfce2cd722d788e3d3bf81d, not @v1.0.1 and not @main — a tag can be moved by its
owner, a fb57f8b93748b593adfce2cd722d788e3d3bf81d cannot. The trailing comment is what Dependabot reads to compute bumps.

Consumers on v1.0.0 need no action: Dependabot will propose this bump automatically,
after the 7-day cooldown.

v1.0.0

First tagged release. The actions here have built production images for eight repositories since November 2025; this is the point where that gets a version number.

Pin to this release

Reference the commit SHA, with the tag as a trailing comment:

uses: pubky/ci-workflows/.github/actions/docker/build_and_push@e6d3b38b5ebfa97b86595cb44f3a86695e473b09 # v1.0.0

Not @v1.0.0, and not @main. A tag is a name its owner can move; a SHA is not. The comment is what makes the line readable and what Dependabot reads to compute bumps.

@main continues to work and is unchanged in behaviour, but it means you receive every future change the moment it merges, without review.

What is in it

• The five docker/* actions are pinned to commit SHAs at their current major, so this release runs byte-identical upstream code to what @main ran before it
• build_and_push no longer references a sibling action at @main; get_head_commit_hash is inlined, so pinning this release pins the whole chain
• 11 shell interpolations of ${{ inputs.* }} moved into env: blocks
• zizmor runs on every pull request and blocks the merge; results upload to the Security tab
• Smoke tests build a real image through build_and_push on linux/amd64 and linux/amd64,linux/arm64 on every pull request
• Dependabot raises action bumps weekly, with a 7-day cooldown

Deprecated

docker/get_head_commit_hash — build_and_push now resolves the commit hash itself. The action still works and is still supported; it has three remaining callers in pubky-app and pubky-stack.

Refs pubky/pubky-stack#281