Don't push container image on PR, but compare to published image #131

Workflow file for this run

	name: ci

	on:
	push:
	branches: [main]
	paths:
	- '**/Dockerfile'
	- '*/toolsets/.json'
	pull_request:
	paths:
	- '**/Dockerfile'
	- '*/toolsets/.json'
	- '**/.github/workflows/ci.yml'

	permissions:
	contents: read
	packages: write
	pull-requests: write

	jobs:
	build:
	runs-on: ubuntu-latest
	strategy:
	matrix:
	include:
	- from-version: '22.04'
	from-version-major: '22'
	from-version-minor: '04'
	distro: 'ubuntu'
	codename: 'jammy'
	from-flavor: 'act'
	- from-version: '20.04'
	from-version-major: '20'
	from-version-minor: '04'
	distro: 'ubuntu'
	codename: 'focal'
	from-flavor: 'act'
	services:
	registry:
	image: registry:2
	ports: [5000]
	# options: --entrypoint /bin/registry
	env:
	CACHE_FROM_REGISTRY: docker.io
	IMAGE_NAME: ${{ format('{0}-{1}', matrix.distro, matrix.from-flavor) }}
	IMAGE_REPOSITORY: ${{ format('{0}/{1}-{2}', github.repository_owner, matrix.distro, matrix.from-flavor) }}
	SHA: ${{ github.event.pull_request.head.sha \|\| github.event.after }}
	REGISTRY: ${{ github.event_name == 'pull_request' && format('{0}:{1}','localhost', '5000') \|\| 'docker.io' }}
	steps:
	- uses: actions/checkout@v4

	- name: Free up disk space
	uses: ./.github/actions/free-space
	with:
	deleteDotnet: 'true'
	deleteAndroid: 'true'

	- name: Set up QEMU
	uses: docker/setup-qemu-action@v2

	- name: Set up Docker Buildx
	uses: docker/[email protected]
	with:
	driver: ${{ github.event_name == 'pull_request' && 'docker' \|\| 'docker-container' }}
	driver-opts: ${{ github.event_name == 'pull_request' && 'network=host,image=moby/buildkit:v0.12.2' \|\| '' }}
	install: ${{ github.event_name == 'pull_request' && true \|\| false }}

	# - name: Login to GitHub Container Registry
	# uses: docker/[email protected]
	# with:
	# registry: ghcr.io
	# username: ${{ github.repository_owner }}
	# password: ${{ secrets.GITHUB_TOKEN }}

	# Login against a Docker registry
	# https://github.com/docker/login-action
	- name: Login to Docker Hub
	uses: docker/[email protected]
	if: vars.DOCKERHUB_USER != ''
	with:
	registry: ${{ env.CACHE_FROM_REGISTRY }}
	username: ${{ vars.DOCKERHUB_USER }}
	password: ${{ secrets.DOCKERHUB_TOKEN }}
	logout: true

	# Extract metadata (tags, labels) for Docker
	# https://github.com/docker/metadata-action
	- name: Extract Docker metadata
	id: meta
	uses: docker/[email protected]
	with:
	github-token: ${{ secrets.GITHUB_TOKEN }}
	images: ${{ github.event_name != 'pull_request' && format('{0}/{1}', env.REGISTRY, env.IMAGE_REPOSITORY) \|\| env.IMAGE_REPOSITORY }}
	tags: \|
	type=sha,prefix=${{ matrix.from-version }}-,format=short,enable={{is_default_branch}},priority=1000
	type=raw,value=${{ matrix.from-version }},enable={{is_default_branch}},priority=900
	type=raw,value=${{ matrix.from-version }}-${{ github.head_ref \|\| github.ref_name }},priority=600
	flavor: \|
	latest=${{ github.ref == format('refs/heads/{0}', 'main') && matrix.from-version == '22.04' }}
	labels: \|
	org.opencontainers.image.authors=['${{ env.REPOSITORY_LINK }}','${{ github.actor }}']
	org.opencontainers.image.description=${{ github.event.repository.description }}
	org.opencontainers.image.documentation=${{ env.REPOSITORY_LINK }}
	org.opencontainers.image.revision=${{ env.SHA }}
	org.opencontainers.image.source=${{ github.repositoryUrl }}
	org.opencontainers.image.title=${{ env.IMAGE_REPOSITORY }}:${{ matrix.from-version }}-${{ github.head_ref \|\| github.ref_name }}
	org.opencontainers.image.url=${{ env.REPOSITORY_LINK }}/blob/${{ env.SHA }}/linux/${{ matrix.distro }}/Dockerfile
	org.opencontainers.image.vendor=${{ github.repository_owner }}
	env:
	REPOSITORY_LINK: https://github.com/${{ github.repository }}

	# Build and push Docker image with Buildx (don't push on PR)
	# https://github.com/docker/build-push-action
	- name: Build and push
	id: build
	uses: docker/build-push-action@v4
	with:
	context: .
	# github-token for the repository context
	github-token: ${{ secrets.GITHUB_TOKEN }}
	file: ./linux/${{ matrix.distro }}/Dockerfile
	platforms: linux/amd64,linux/arm64
	labels: ${{ steps.meta.outputs.labels }}
	tags: ${{ steps.meta.outputs.tags }}
	build-args: \|
	FROM_IMAGE=buildpack-deps
	FROM_VERSION_MAJOR=${{ matrix.from-version-major }}
	FROM_VERSION_MINOR=${{ matrix.from-version-minor }}
	FROM_FLAVOR=${{ matrix.from-flavor }}
	DISTRO=${{ matrix.distro }}
	CODENAME=${{ matrix.codename }}
	# caching to speed up the build
	cache-from: \|
	${{ format('type=registry,ref={0}:{1}', env.CACHE_FROM_REGISTRY, matrix.from-version) }}
	${{ format('type=registry,ref={0}:cache-{1}',env.CACHE_FROM_REGISTRY, matrix.codename) }}
	# cache exporter doesn't work with docker driver
	cache-to: ${{ github.event_name != 'pull_request' && format('type=registry,ref={0}:cache-{1},mode=max',env.REGISTRY_IMAGE, matrix.codename) \|\| '' }}
	# this will give us some useful information about the build
	provenance: mode=max
	# push if not a PR, load if a PR
	push: ${{ github.event_name != 'pull_request' }}
	load: ${{ github.event_name == 'pull_request' }}
	env:
	REGISTRY_IMAGE: ${{ format('{0}/{1}', env.REGISTRY, env.IMAGE_REPOSITORY) }}

	# vulnerability scanning to verify PRs
	- name: Docker Scout
	id: docker-scout
	continue-on-error: true
	uses: docker/[email protected]
	with:
	command: sbom,compare
	image: ${{ steps.meta.outputs.tags }}
	# image: ${{ format('{0}:{1}-{2}', env.IMAGE_REPOSITORY, matrix.from-version, github.head_ref \|\| github.ref_name) }}
	to: ${{ format('{0}/{1}:{2}', env.CACHE_FROM_REGISTRY, env.IMAGE_REPOSITORY, matrix.from-version) }}
	organization: ${{ vars.DOCKERHUB_USER }}
	ignore-unchanged: true
	only-severities: critical
	write-comment: ${{ github.actor != 'nektos/act' }}
	keep-previous-comments: true
	summary: ${{ github.actor != 'nektos/act' }}
	github-token: ${{ secrets.GITHUB_TOKEN }}
	dockerhub-user: ${{ vars.DOCKERHUB_USER }}
	dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN }}

	# ToDo: Move into a separate workflow and depend on ci and mega-linter
	approve-pr:
	name: Approve PR
	runs-on: ubuntu-latest
	needs: [build]
	if: contains(fromJson('["mauwii","dependabot[bot]"]'), github.triggering_actor) && github.event_name == 'pull_request' && needs.build.result == 'success'
	permissions:
	contents: read
	pull-requests: write
	actions: write
	steps:
	- name: Approve PR
	run: gh pr review --approve "$PR_URL"
	env:
	PR_URL: ${{github.event.pull_request.html_url}}
	GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

	# # Disabling this since I enabled the auto-merge option for the repo
	# - name: Merge PR
	# run: gh pr merge --auto --merge "$PR_URL"
	# env:
	# PR_URL: ${{github.event.pull_request.html_url}}
	# GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

	# # Disabling this since github-actions-cache is currently not used
	# - name: Clean cache
	# run: \|
	# gh extension install actions/gh-actions-cache

	# REPO=${{ github.repository }}
	# BRANCH=refs/heads/${{ github.head_ref }}

	# echo "Fetching list of cache key"
	# cacheKeysForPR=$(gh actions-cache list -R "${REPO}" -B "${BRANCH}" \| cut -f 1)

	# if [ -n "$cacheKeysForPR" ]; then
	# ## Setting this to not fail the workflow while deleting cache keys.
	# set +e
	# echo "Deleting caches..."
	# for cacheKey in $cacheKeysForPR; do
	# gh actions-cache delete "${cacheKey}" -R "${REPO}" -B "${BRANCH}" --confirm
	# done
	# echo "Done"
	# ## Restore the fail on error.
	# set -e
	# else
	# echo "No cache keys found for this PR"
	# fi
	# env:
	# GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Don't push container image on PR, but compare to published image #131

Workflow file

Don't push container image on PR, but compare to published image #131

Jobs

Run details

Workflow file for this run