Skip to content

ci: run docker builds from PRs #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
potyl wants to merge 2 commits into from
Closed

ci: run docker builds from PRs #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0a82197
ci: docker build is now done with a shared workflow
potyl Sep 29, 2025
54e363d
ci: run docker builds from PRs
potyl Sep 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions .github/workflows/docker-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
name: Build docker image

on:
workflow_call:
inputs:
push:
description: Indicates if the docker image has to be pushed
type: boolean
default: false
outputs:
image-tag:
description: Image tag used
value: ${{ github.event.pull_request.head.sha || github.sha }}

defaults:
run:
shell: bash

jobs:
build:
name: Docker Build 🐋
runs-on: x1-core
permissions:
id-token: write
contents: read
packages: write
steps:
- name: Docker build
uses: cloudbeds/composite-actions/docker/build-push/remote@v2
with:
push: ${{ inputs.push }}
14 changes: 4 additions & 10 deletions .github/workflows/merge-main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,13 +10,7 @@ on:
jobs:
build-push:
name: Build and push application image
runs-on: x1-core
permissions:
id-token: write
contents: read
steps:

- name: Build and push application image
uses: cloudbeds/composite-actions/docker/build-push/remote@v2
with:
push: true
uses: ./.github/workflows/docker-build.yaml
secrets: inherit
with:
push: true
21 changes: 21 additions & 0 deletions .github/workflows/pull-request.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
name: Pull Request

on:
pull_request:

# Cancel existing workflows running for this PR
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

defaults:
run:
shell: bash

jobs:
docker-build:
name: Docker Build
uses: ./.github/workflows/docker-build.yaml
secrets: inherit
with:
push: false
Comment on lines +17 to +21

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 4 months ago

To fix this problem, we should introduce a permissions block that explicitly scopes the GITHUB_TOKEN permissions to the minimum needed for the job(s). Since we don't see any evidence from this code alone that write permissions or extra scopes are required, the best default is contents: read, which is commonly the safest minimum. You can add the permissions: key to the root (top-level) of the workflow so that it applies to all jobs unless overridden, or to the individual job(s); the simplest approach is at the top level, beneath name: and above on:. This change only involves inserting a few lines at the top of .github/workflows/pull-request.yaml.

Suggested changeset 1
.github/workflows/pull-request.yaml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
--- a/.github/workflows/pull-request.yaml
+++ b/.github/workflows/pull-request.yaml
@@ -1,4 +1,6 @@
 name: Pull Request
+permissions:
+  contents: read
 
 on:
   pull_request:
EOF
@@ -1,4 +1,6 @@
name: Pull Request
permissions:
contents: read

on:
pull_request:
Copilot is powered by AI and may make mistakes. Always verify output.
Loading