Don't push container image on PR, but compare to published image

.github/workflows/ci.yml

@@ -2,6 +2,7 @@ name: ci
 
 on:
   push:
+    branches: [main]
     paths:
       - '**/Dockerfile'
       - '**/toolsets/*.json'
@@ -21,6 +22,9 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
+        platforms: ['linux/amd64,linux/arm64']
+        # platforms: ${{ github.event_name == 'pull_request' && fromJson(format('["{0}", "{1}"]', 'linux/amd64','linux/arm64')) || fromJson('["linux/amd64,linux/arm64"]') }}
+        from-version: ['22.04', '20.04']
         include:
           - from-version: '22.04'
             from-version-major: '22'
@@ -34,13 +38,18 @@ jobs:
             distro: 'ubuntu'
             codename: 'focal'
             from-flavor: 'act'
+    services:
+      registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+        # options: --entrypoint /bin/registry
     env:
-      REGISTRY: docker.io
+      CACHE_FROM_REGISTRY: docker.io
       IMAGE_NAME: ${{ format('{0}-{1}', matrix.distro, matrix.from-flavor) }}
-      IMAGE_REPOSITORY: ${{ format('{0}/{1}', github.repository_owner, format('{0}-{1}', matrix.distro, matrix.from-flavor)) }}
+      IMAGE_REPOSITORY: ${{ format('{0}/{1}-{2}', vars.DOCKERHUB_USER || github.repository_owner, matrix.distro, matrix.from-flavor) }}
       SHA: ${{ github.event.pull_request.head.sha || github.event.after }}
-      DOCKERHUB_USERNAME: ${{ github.repository_owner }}
-      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+      REGISTRY: ${{ github.ref == 'refs/heads/main' && format('{0}', vars.DOCKERHUB_USER != '' && 'docker.io' || 'ghcr.io') || 'localhost:5000' }}
     steps:
       - uses: actions/checkout@v4
 
@@ -55,40 +64,48 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/[email protected]
-        # with:
-        #   driver-opts: |
-        #     image=moby/buildkit:v0.12.2
-        #     network=host
-
-      # - name: Login to GitHub Container Registry
-      #   uses: docker/[email protected]
-      #   with:
-      #     registry: ghcr.io
-      #     username: ${{ github.repository_owner }}
-      #     password: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          driver: docker-container
+          driver-opts: image=moby/buildkit:v0.12.2${{ github.ref != 'refs/heads/main' && ',network=host' || '' }}
+          install: true
+          platforms: ${{ matrix.platforms }}
+
+      # Login to github container registry
+      # https://github.com/docker/login-action
+      - name: Login to GitHub Container Registry
+        uses: docker/[email protected]
+        if: vars.DOCKERHUB_USER == ''
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       # Login against a Docker registry
       # https://github.com/docker/login-action
       - name: Login to Docker Hub
         uses: docker/[email protected]
+        if: vars.DOCKERHUB_USER != ''
         with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ env.DOCKERHUB_USERNAME }}
-          password: ${{ env.DOCKERHUB_TOKEN }}
+          registry: docker.io
+          username: ${{ vars.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
           logout: true
 
       # Extract metadata (tags, labels) for Docker
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4.4.0
+        uses: docker/metadata-action@v4.6.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
-          images: ${{ format('{0}/{1}', env.REGISTRY, env.IMAGE_REPOSITORY) }}
+          # images: ${{ github.actor != 'nektos/act' && format('{0}/{1}', env.REGISTRY, env.IMAGE_REPOSITORY) || env.IMAGE_REPOSITORY }}
+          images: |
+            ${{ env.REGISTRY }}/${{ vars.DOCKERHUB_USER }}/${{ env.IMAGE_NAME }}
+            ${{ vars.DOCKERHUB_USER }}/${{ env.IMAGE_NAME }}
           tags: |
+            type=sha,prefix=${{ matrix.from-version }}-,format=short,enable={{is_default_branch}},priority=1000
             type=raw,value=${{ matrix.from-version }},enable={{is_default_branch}},priority=900
             type=raw,value=${{ matrix.from-version }}-${{ github.head_ref || github.ref_name }},priority=600
-            type=sha,prefix=${{ matrix.from-version }}-,format=short,enable={{is_default_branch}},priority=100
           flavor: |
             latest=${{ github.ref == format('refs/heads/{0}', 'main') && matrix.from-version == '22.04' }}
           labels: |
@@ -97,7 +114,7 @@ jobs:
             org.opencontainers.image.documentation=${{ env.REPOSITORY_LINK }}
             org.opencontainers.image.revision=${{ env.SHA }}
             org.opencontainers.image.source=${{ github.repositoryUrl }}
-            org.opencontainers.image.title=${{ env.IMAGE_REPOSITORY }}:${{ github.head_ref || github.ref_name }}
+            org.opencontainers.image.title=${{ env.IMAGE_REPOSITORY }}:${{ matrix.from-version }}-${{ github.head_ref || github.ref_name }}
             org.opencontainers.image.url=${{ env.REPOSITORY_LINK }}/blob/${{ env.SHA }}/linux/${{ matrix.distro }}/Dockerfile
             org.opencontainers.image.vendor=${{ github.repository_owner }}
         env:
@@ -113,7 +130,7 @@ jobs:
           # github-token for the repository context
           github-token: ${{ secrets.GITHUB_TOKEN }}
           file: ./linux/${{ matrix.distro }}/Dockerfile
-          platforms: linux/amd64,linux/arm64
+          platforms: ${{ matrix.platforms }}
           labels: ${{ steps.meta.outputs.labels }}
           tags: ${{ steps.meta.outputs.tags }}
           build-args: |
@@ -125,34 +142,39 @@ jobs:
             CODENAME=${{ matrix.codename }}
           # caching to speed up the build
           cache-from: |
-            type=registry,ref=${{ env.REGISTRY_IMAGE }}:${{ matrix.from-version }}-${{ github.head_ref || github.ref_name }}
-            type=registry,ref=${{ env.REGISTRY_IMAGE }}:cache-${{ matrix.codename }}
-          # cache exporter doesn't work with docker driver
-          cache-to: |
-            type=registry,ref=${{ env.REGISTRY_IMAGE }}:cache-${{ matrix.codename }},mode=max
+            ${{ format('type=registry,ref={0}:{1}', env.CACHE_FROM_REGISTRY_IMAGE, matrix.from-version) }}
+            ${{ format('type=registry,ref={0}:cache-{1}', env.CACHE_FROM_REGISTRY_IMAGE, matrix.codename) }}
+          # don't export cache on PR
+          cache-to: ${{ github.ref == 'refs/heads/main' && format('type=registry,ref={0}:cache-{1},mode=max', env.REGISTRY_IMAGE, matrix.codename) || '' }}
           # this will give us some useful information about the build
           provenance: mode=max
-          push: true
-          # outputs: type=image,name=${{ env.REGISTRY_IMAGE }}:${{ matrix.from-version }}-${{ github.head_ref || github.ref_name }},push=true
+          # push if not building with act
+          push: ${{ github.actor != 'nektos/act' }}
+          load: ${{ github.actor == 'nektos/act' }}
         env:
           REGISTRY_IMAGE: ${{ format('{0}/{1}', env.REGISTRY, env.IMAGE_REPOSITORY) }}
+          CACHE_FROM_REGISTRY_IMAGE: ${{ format('{0}/{1}', env.CACHE_FROM_REGISTRY, env.IMAGE_REPOSITORY) }}
 
       # vulnerability scanning to verify PRs
       - name: Docker Scout
         id: docker-scout
         continue-on-error: true
         uses: docker/[email protected]
         with:
-          command: sbom,compare
-          image: ${{ steps.meta.outputs.tags }}
-          to: ${{ format('{0}/{1}:{2}', env.REGISTRY, env.IMAGE_REPOSITORY, matrix.from-version) }}
-          organization: ${{ github.repository_owner }}
+          command: ${{ github.ref == 'refs/heads/main' && 'sbom,compare' || 'compare' }}
+          image: ${{ github.actor != 'nektos/act' && steps.meta.outputs.tags || format('{0}:{1}-{2}', env.IMAGE_REPOSITORY, matrix.from-version, github.head_ref || github.ref_name) }}
+          # image: ${{ steps.meta.outputs.tags }}
+          # image: ${{ format('{0}:{1}-{2}', env.IMAGE_REPOSITORY, matrix.from-version, github.head_ref || github.ref_name) }}
+          to: ${{ format('{0}/{1}:{2}-{3}', env.CACHE_FROM_REGISTRY, env.IMAGE_REPOSITORY, matrix.from-version, 'main') }}
+          organization: ${{ vars.DOCKERHUB_USER }}
           ignore-unchanged: true
           only-severities: critical
           write-comment: ${{ github.actor != 'nektos/act' }}
           keep-previous-comments: true
           summary: ${{ github.actor != 'nektos/act' }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
+          dockerhub-user: ${{ vars.DOCKERHUB_USER }}
+          dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN }}
 
   # ToDo: Move into a separate workflow and depend on ci and mega-linter
   approve-pr:

.github/workflows/mega-linter.yml

@@ -37,6 +37,7 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@v3
         with:
+          set-safe-directory: true
           # token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
           token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances

.vscode/extensions.json

@@ -1,6 +1,5 @@
 {
   "recommendations": [
-    "AquaSecurityOfficial.trivy-vulnerability-scanner",
     "editorconfig.editorconfig",
     "esbenp.prettier-vscode",
     "exiasr.hadolint",

README.md

@@ -1,33 +1,32 @@
 # 🐳 Docker images for [nektos/act](https://github.com/nektos/act)
 
-[![Docker Pulls](https://badgen.net/docker/pulls/mauwii/ubuntu-act?icon=docker&label=pulls)](https://hub.docker.com/r/mauwii/ubuntu-act/)
-[![Docker Image Size](https://badgen.net/docker/size/mauwii/ubuntu-act?icon=docker&label=image%20size)](https://hub.docker.com/r/mauwii/ubuntu-act/)
-[![Docker Stars](https://badgen.net/docker/stars/mauwii/ubuntu-act?icon=docker&label=stars)](https://hub.docker.com/r/mauwii/ubuntu-act/)
-[![Github stars](https://badgen.net/github/stars/mauwii/act-docker-images?icon=github&label=stars)](https://github.com/mauwii/act-docker-images)
-[![Github forks](https://badgen.net/github/forks/mauwii/act-docker-images?icon=github&label=forks)](https://github.com/mauwii/act-docker-images/fork)
-[![Github issues](https://badgen.net/github/issues/mauwii/act-docker-images/?icon=github&label=issues)](https://github.com/mauwii/act-docker-images/issues)
-[![Github last-commit](https://badgen.net/github/last-commit/mauwii/act-docker-images/?color=blue&icon=github&label=last-commit)](https://github.com/mauwii/act-docker-images/commits/)
-
-[![ci](https://github.com/mauwii/act-docker-images/actions/workflows/ci.yml/badge.svg?branch=main&event=push)](https://github.com/mauwii/act-docker-images/actions/workflows/ci.yml)
-[![Docker-Hub description](https://github.com/mauwii/act-docker-images/actions/workflows/dockerhub-description.yml/badge.svg?branch=main)](https://github.com/mauwii/act-docker-images/actions/workflows/dockerhub-description.yml)
-[![MegaLinter](https://github.com/mauwii/act-docker-images/workflows/MegaLinter/badge.svg?branch=main)](https://github.com/mauwii/act-docker-images/actions?query=workflow%3AMegaLinter+branch%3Amain)
+[![Docker Pulls](https://badgen.net/docker/pulls/mauwii/ubuntu-act?icon=docker&label=pulls)][dockerHub]
+[![Docker Image Size](https://badgen.net/docker/size/mauwii/ubuntu-act?icon=docker&label=image%20size)][dockerHub]
+[![Docker Stars](https://badgen.net/docker/stars/mauwii/ubuntu-act?icon=docker&label=stars)][dockerHub]
+[![Github stars](https://badgen.net/github/stars/mauwii/act-docker-images?icon=github&label=stars)][githubRepo]
+[![Github forks](https://badgen.net/github/forks/mauwii/act-docker-images?icon=github&label=forks)][githubFork]
+[![Github issues](https://badgen.net/github/issues/mauwii/act-docker-images/?icon=github&label=issues)][githubIssues]
+[![Github last-commit](https://badgen.net/github/last-commit/mauwii/act-docker-images/?color=blue&icon=github&label=last-commit)][githubCommits]
+
+[![ci](https://github.com/mauwii/act-docker-images/actions/workflows/ci.yml/badge.svg?branch=main&event=push)][workflowCi]
+[![Docker-Hub description](https://github.com/mauwii/act-docker-images/actions/workflows/dockerhub-description.yml/badge.svg?branch=main)][workflowDhDesc]
+[![MegaLinter](https://github.com/mauwii/act-docker-images/workflows/MegaLinter/badge.svg?branch=main&event=push)][workflowMegaLinter]
 
 ## ⚠️ Heavily under construction... ⚠️
 
 ...so please do not use this anywhere in production ❗
 
 ## What
 
-The docker images in this repository can be used with [nektos/act](https://github.com/nektos/act),
-which is a very handy tool to run your github workflows locally.
+The docker images in this repository can be used with [nektos/act][nektosActRepo], which is a very
+handy tool to run your github workflows locally.
 
 If you don't know it yet, I highly recommend to check it out 🤓
 
 ## Why
 
 In the other Images I had problems with executing azure related tools, so I decided to create my own
-image which is heavily inspired by the images of
-[catthehacker](https://github.com/catthehacker/docker_images)
+image which is heavily inspired by the images of [catthehacker][catthehackerImages]
 
 ## How to use
 
@@ -42,8 +41,8 @@ The easiest way is to add those lines in your `~/.actrc`:
 -P ubuntu-20.04=mauwii/ubuntu-act:20.04
 ```
 
-For further Informations about nektos/arc and how to use it, checkout the
-[nektos documentation📖](https://nektosact.com/beginner/index.html)
+For further Informations about nektos/arc and how to use it, checkout the [nektos
+documentation📖][nektosDocs]
 
 ## How I run act on my M2-Max 💻
 
@@ -59,13 +58,6 @@ For further Informations about nektos/arc and how to use it, checkout the
   alias act='gh act -s GITHUB_TOKEN="$(gh auth token)"'
   ```
 
-- export DOCKER_HOST env
-
-  ```bash
-  DOCKER_HOST=$(docker context inspect --format '{{.Endpoints.docker.Host}}')
-  export DOCKER_HOST
-  ```
-
 - Docker-Desktop settings:
 
   - Advanced:
@@ -76,6 +68,23 @@ For further Informations about nektos/arc and how to use it, checkout the
 
     ✔️ All Beta Features enabled (containerd, wasm, rosetta and builds view)
 
+  - Docker Engine (`~/.docker/daemon.json`):
+
+    ```json
+    {
+      "builder": {
+        "gc": {
+          "defaultKeepStorage": "20GB",
+          "enabled": true
+        }
+      },
+      "experimental": true,
+      "features": {
+        "buildkit": true
+      }
+    }
+    ```
+
 - `~/.actrc`:
 
   ```text
@@ -95,3 +104,21 @@ npx mega-linter-runner \
     -e GITHUB_TOKEN="$(gh auth token)" \
     --remove-container
 ```
+
+[dockerHub]: https://hub.docker.com/r/mauwii/ubuntu-act/ "DockerHub"
+[githubRepo]: https://github.com/mauwii/act-docker-images/ "GitHub repository"
+[githubFork]: https://github.com/mauwii/act-docker-images/fork/ "GitHub forks"
+[githubIssues]: https://github.com/mauwii/act-docker-images/issues/ "GitHub issues"
+[githubCommits]: https://github.com/mauwii/act-docker-images/commits/ "GitHub commits"
+[workflowCi]: https://github.com/mauwii/act-docker-images/actions/workflows/ci.yml "ci workflow"
+[workflowDhDesc]:
+  https://github.com/mauwii/act-docker-images/actions/workflows/dockerhub-description.yml
+  "DockerHub Description Workflow"
+[workflowMegaLinter]:
+  https://github.com/mauwii/act-docker-images/actions?query=workflow%3AMegaLinter+branch%3Amain
+  "MegaLinter Workflow"
+[nektosActRepo]: https://github.com/nektos/act "nektos/act git repository"
+[catthehackerImages]:
+  https://github.com/catthehacker/docker_images
+  "catthehacker/docker_images repo"
+[nektosDocs]: https://nektosact.com/beginner/index.html "nektos/act docs"