Merged
Conversation
Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
|
|
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Reviewer's GuideAdds a new GitHub Actions workflow to build and publish Docker images to Docker Hub on pushes (tags and main) and build-only on pull requests, including metadata tagging, SBOM/provenance control, and registry authentication. Flow diagram for Docker.yml GitHub Actions job executionflowchart TD
Start["Workflow trigger"]
Triggers{"Event type"}
PushMain["push to main"]
PushTag["push tag *"]
PullRequest["pull_request to any branch"]
JobStart["Start job build\n(runs-on ubuntu-latest)"]
Auth["Authenticate to registry\n docker/login-action@v3\n uses REGISTRY, REGISTRY_USER, REGISTRY_TOKEN"]
SetupBuildx["Setup Docker buildx\n docker/setup-buildx-action@v3"]
Meta["Extract Docker metadata\n docker/metadata-action@v5\n images: REGISTRY/IMAGE_NAME\n labels: image.revision=SHA\n tags: edge, semver, sha"]
BuildPush["Build Docker image\n docker/build-push-action@v6"]
PushDecision{"Event is pull_request?"}
SBOMProvenance["Set sbom/provenance flags"]
End["Job finished"]
Start --> Triggers
Triggers -->|push main| PushMain
Triggers -->|push tag| PushTag
Triggers -->|pull_request| PullRequest
PushMain --> JobStart
PushTag --> JobStart
PullRequest --> JobStart
JobStart --> Auth --> SetupBuildx --> Meta --> SBOMProvenance
SBOMProvenance --> PushDecision
PushDecision -->|Yes, pull_request| BuildPush
PushDecision -->|No, push main/tag| BuildPush
BuildPush --> End
%% Internal logic of BuildPush
subgraph BuildPushConfig["docker/build-push-action@v6 configuration"]
PRCheck{"github.event_name == pull_request"}
SBOMFlag["sbom = (not PR)"]
ProvFlag["provenance = (not PR)"]
PushFlag["push = (not PR)"]
LoadFlag["load = PR"]
TagsLabels["tags, labels from meta.outputs"]
CacheFrom["cache-from: type=gha"]
CacheTo["cache-to: type=gha, mode=max"]
end
PushDecision --> PRCheck
PRCheck --> SBOMFlag
PRCheck --> ProvFlag
PRCheck --> PushFlag
PRCheck --> LoadFlag
SBOMFlag --> TagsLabels
ProvFlag --> TagsLabels
PushFlag --> TagsLabels
LoadFlag --> TagsLabels
TagsLabels --> CacheFrom
CacheFrom --> CacheTo
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 3 issues, and left some high level feedback:
- The workflow never checks out the repository, so
docker/build-push-actionwill have nothing to build; add anactions/checkoutstep before the build. - In the Docker metadata step,
branch=$repo.default_branchuses an undefinedrepovariable; replace this with an appropriate GitHub context value (for example fromgithuborgithub.event.repository).
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The workflow never checks out the repository, so `docker/build-push-action` will have nothing to build; add an `actions/checkout` step before the build.
- In the Docker metadata step, `branch=$repo.default_branch` uses an undefined `repo` variable; replace this with an appropriate GitHub context value (for example from `github` or `github.event.repository`).
## Individual Comments
### Comment 1
<location> `.github/workflows/Docker.yml:33-34` </location>
<code_context>
+ username: ${{ secrets.REGISTRY_USER }}
+ password: ${{ secrets.REGISTRY_TOKEN }}
+
+ - name: Setup Docker buildx
+ uses: docker/setup-buildx-action@v3
+
+ # Extract metadata (tags, labels) for Docker
</code_context>
<issue_to_address>
**issue (bug_risk):** Repository is never checked out, so the Docker build context will be empty
Because this workflow never runs `actions/checkout`, `docker/build-push-action` will see an empty build context (its default `context: .` will only include the empty workspace). This can cause the build to fail or produce an empty image. Add a `- uses: actions/checkout@v4` step before setting up buildx.
</issue_to_address>
### Comment 2
<location> `.github/workflows/Docker.yml:26-31` </location>
<code_context>
+
+ steps:
+ # Authenticate to the container registry
+ - name: Authenticate to registry ${{ env.REGISTRY }}
+ uses: docker/login-action@v3
+ with:
+ registry: ${{ env.REGISTRY }}
+ username: ${{ secrets.REGISTRY_USER }}
+ password: ${{ secrets.REGISTRY_TOKEN }}
+
+ - name: Setup Docker buildx
</code_context>
<issue_to_address>
**issue:** Logging into Docker Hub on pull_request runs will fail for forks due to unavailable secrets
Because this job runs on `pull_request` events, secrets like `REGISTRY_USER` and `REGISTRY_TOKEN` won’t be available for PRs from forks, so the login step will always fail there. If you only need to push on non-PR runs, consider adding a condition (e.g. `if: github.event_name != 'pull_request'`) or splitting the workflow so forked PRs build without attempting a registry login.
</issue_to_address>
### Comment 3
<location> `.github/workflows/Docker.yml:44-45` </location>
<code_context>
+ images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+ labels: |
+ org.opencontainers.image.revision=${{ env.SHA }}
+ tags: |
+ type=edge,branch=$repo.default_branch
+ type=semver,pattern=v{{version}}
+ type=sha,prefix=,suffix=,format=short
</code_context>
<issue_to_address>
**question (bug_risk):** The edge tag configuration references `$repo.default_branch`, which may not be a valid placeholder
`docker/metadata-action` examples use explicit branch names like `type=edge,branch=main`. It’s unclear whether `branch=$repo.default_branch` is a supported placeholder, so this may fail to resolve and break edge tagging. Please switch to the actual default branch name (e.g. `main`) or a documented expression that resolves the repo’s default branch.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by Sourcery
CI: