Create docker.yml

[Dargon789]

• Because this PR includes a bug fix, relevant tests have been included.
• Because this PR includes a new feature, the change was previously discussed on an Issue or with someone from the team.
• I didn't do anything of this.

---

Summary by Sourcery

Add a GitHub Actions workflow to build, publish, and sign Docker images for the project using GitHub Container Registry.

CI:

• Introduce a Docker GitHub Actions workflow that builds images on pushes, tags, pull requests, and a daily schedule.
• Configure authentication, metadata extraction, and buildx-based build-and-push steps for Docker images, including image signing with cosign outside of pull requests.

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[sourcery-ai]

Reviewer's Guide

Adds a new GitHub Actions workflow to build, optionally push, and sign Docker images for the repository on pushes, tags, PRs, and a scheduled run, using Docker Buildx, GitHub Container Registry, and cosign.

File-Level Changes

Change	Details	Files
Introduce a Docker CI workflow that builds images on various triggers and can publish signed images to GitHub Container Registry.	Create a Docker workflow triggered by schedule, pushes to main, version tags, and pull requests Define REGISTRY and IMAGE_NAME environment variables to target GitHub Container Registry based on the repository Add a build job using Docker Buildx to build the image and conditionally push it for non-PR events Install cosign and sign published images using an OIDC identity token for non-PR events Configure authentication to the registry using the GitHub actor and GITHUB_TOKEN, and apply tags/labels via docker/metadata-action with cache configuration	.github/workflows/docker.yml

Possibly linked issues

• Create docker.yml #1794: The PR’s docker.yml implements the Buildx, registry, and cosign-based workflow described in the issue diagrams.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
hardhat-project-uz7z	Ready	Preview	Comment	Nov 23, 2025 3:18am
next-lrrp	Ready	Preview	Comment	Nov 23, 2025 3:18am

[sourcery-ai]

Hey there - I've reviewed your changes and found some issues that need to be addressed.

• The jobs.build section is misstructured (a step is defined before runs-on, and runs-on/permissions appear at the wrong indentation level), so the workflow likely won't be parsed correctly by GitHub Actions—please align it with the standard jobs.<job_id>.runs-on -> steps structure.
• The early docker build step uses placeholder values (path/to/Dockerfile, my-image-name) that are inconsistent with the later metadata-based tagging and image naming; consider either removing this standalone build or wiring it into the same IMAGE_NAME/metadata scheme used by the build-push-action.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The `jobs.build` section is misstructured (a step is defined before `runs-on`, and `runs-on`/`permissions` appear at the wrong indentation level), so the workflow likely won't be parsed correctly by GitHub Actions—please align it with the standard `jobs.<job_id>.runs-on` -> `steps` structure.
- The early `docker build` step uses placeholder values (`path/to/Dockerfile`, `my-image-name`) that are inconsistent with the later metadata-based tagging and image naming; consider either removing this standalone build or wiring it into the same `IMAGE_NAME`/metadata scheme used by the `build-push-action`.

## Individual Comments

### Comment 1
<location> `.github/workflows/docker.yml:26-30` </location>
<code_context>
+
+
+jobs:
+  build:
+    - name: Build the Docker image
+      run: docker build . --file path/to/Dockerfile --tag my-image-name:$(date +%s)
+
+  runs-on: ubuntu-latest
+   permissions:
+      contents: read
</code_context>

<issue_to_address>
**issue (bug_risk):** Job structure/indentation is invalid for a GitHub Actions workflow and will prevent the job from running.

`build` is defined as a mapping, but it directly contains a list item (`- name: Build the Docker image`) instead of a `steps:` block, and `runs-on` is incorrectly aligned at the same level as `build`. This makes the workflow invalid. It should be structured as:

- `jobs:`
  - `build:`
    - `runs-on: ubuntu-latest`
    - `permissions: ...`
    - `steps:`
      - `- name: Build the Docker image`

Move the `- name: Build the Docker image` step under `steps:` (or remove it if redundant) and nest `runs-on`/`permissions` under `build` so GitHub accepts the workflow.
</issue_to_address>

### Comment 2
<location> `.github/workflows/docker.yml:76-78` </location>
<code_context>
+
+      # Build and push Docker image with Buildx (don't push on PR)
+      # https://github.com/docker/build-push-action
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: docker/build-push-action@v5.0.0
+        with:
+          context: ./
</code_context>

<issue_to_address>
**🚨 suggestion (security):** The `docker/build-push-action` is referenced by a mutable tag instead of a pinned commit, which weakens supply-chain security.

Other third-party actions here are pinned to commit SHAs, but this one uses the `@v5.0.0` tag. To avoid unexpected behavior if the tag is retargeted and to align with GitHub’s security guidance, please pin `docker/build-push-action` to its specific commit SHA.

Suggested implementation:

```
      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@COMMIT_SHA_FOR_V5_0_0 # v5.0.0
        with:

```

To fully implement this securely:
1. Replace COMMIT_SHA_FOR_V5_0_0 with the exact commit SHA corresponding to docker/build-push-action v5.0.0 from the official repository: https://github.com/docker/build-push-action/releases.
2. Keep the inline comment # v5.0.0 so humans can still see which version is intended while the workflow is pinned to an immutable commit for supply-chain security.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}