[228] Stop publishing container images that nothing consumes - #232
Merged
Conversation
Nothing consumes the images it publishes: deploy-lean.yml builds its own image and pushes it to ECR on every push to development, the compose files build the mmgis service from the local Dockerfile, and no file in the repo references ghcr.io/nasa-impact. Deleting the workflow ends the ~20 runner-minutes of duplicate arm64+amd64 --no-cache builds on every PR update and stops the registry from accumulating per-PR tags. It also removes the Scorecard Dangerous-Workflow finding from the tag-generation step (#58). The container-build gate is now deploy-lean.yml, which exercises the real Dockerfile on every merge to development; its header comment is updated to record that.
5 tasks
CarsonDavis
marked this pull request as ready for review
July 29, 2026 16:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #228
What
Deletes
.github/workflows/docker-build.yml— the workflow that built the app container twice (arm64 + amd64, serialized,--no-cache) and published both toghcr.io/nasa-impact/mmgison every PR push, plus on pushes tomaster/development, tags, and releases. Also updates the now-stale header comment indeploy-lean.ymlthat claimed docker-build still published the GHCR image (comment-only change; no functional lines touched).Which end state was chosen, and why
The issue left a choice: remove just the
pull_requesttrigger, or delete the workflow entirely. Full deletion, because nothing consumes the fork's GHCR image on any trigger:ghcr.io/nasa-impactreturns zero hits.deploy-lean.ymlbuilds its own image from the local Dockerfile and pushes to ECR on every push todevelopment(.github/workflows/deploy-lean.ymltriggers + build/push steps) — that is the recorded container-build gate: a broken Dockerfile fails the dev deploy within minutes of merging.mmgisservice locally; their only GHCR references are third-party sidecars.sds/unity/terraform/terraform.tfpins the upstreamghcr.io/nasa-ammos/mmgis:development, which this fork's workflow never published.Effect on PR turnaround
The only remaining
pull_requestworkflow is Playwright Tests (unit + config freshness + e2e, ~8 min). Container work — previously 15–33 min of wall clock per PR push — is gone entirely.generate-tags/build-arm64/build-amd64stop reporting once this merges. They must never be listed as required status checks — a required check that never reports blocks every PR until an admin edits the ruleset. Verified today: the repo's only ruleset (require-pr) has no required-status-checks rule, so nothing needs changing now; this is a standing constraint for whoever configures #201.Side effect for #58 (OpenSSF Dangerous-Workflow)
The deleted workflow contained the
github.head_refinterpolation in its tag-generationrun:block — the remaining Dangerous-Workflow finding after #225. Deleting it removes that injection surface, so #58 can likely be closed once Scorecard re-runs (verify there).The two
docker-build.ymlmentions left indocs/adr/deployment/lean/prs/pr-11-aws-infra.mdare a dated planning record and were deliberately left as-is.