ci: build and publish Docker image to GHCR - #89
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved concurrency and credential-exposure risks affect published images.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds a GitHub Actions workflow to build and publish Docker images to GHCR.
Changes:
- Configures Docker Buildx and GHCR authentication.
- Publishes branch, tag, SHA, and
latesttags. - Enables GitHub Actions layer caching.
File summaries
| File | Summary |
|---|---|
.github/workflows/docker.yml |
Adds GHCR publishing but requires concurrency controls and protection against exposing checkout credentials in the image. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| - name: Build and push image | ||
| uses: docker/build-push-action@v6 | ||
| with: | ||
| context: . |
| jobs: | ||
| docker: | ||
| runs-on: ubuntu-latest |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f3b5cfbaae
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - name: Build and push image | ||
| uses: docker/build-push-action@v6 | ||
| with: | ||
| context: . |
There was a problem hiding this comment.
Because this uses a local path context, the repository has no .dockerignore, and Dockerfile:10 runs COPY . ., the image includes .git/config. actions/checkout defaults to persist-credentials: true, so that config contains the job's authenticated Git extraheader until post-job cleanup; every pushed image can therefore contain the active GITHUB_TOKEN. Set persist-credentials: false and exclude .git from the build context before publishing.
Useful? React with 👍 / 👎.
| type=raw,value=latest,enable={{is_default_branch}} | ||
| type=ref,event=branch |
There was a problem hiding this comment.
When two pushes to main are processed concurrently, both runs publish the mutable latest and main tags, so a slower run for the older commit can finish last and move those tags backward. This repository's release workflow also pushes a release commit after ordinary main pushes, routinely creating overlapping Docker runs; add ref-scoped concurrency with cancellation or otherwise ensure only the newest main run can update these tags.
Useful? React with 👍 / 👎.
|
Thanks for adding GHCR publishing. I pushed a maintainer follow-up on this PR to address the review findings: the Docker context now excludes Git and common credential files, checkout no longer persists its token, same-ref builds cancel older runs, and only the default branch can produce the mutable latest tag. I also wired the existing release workflow to dispatch main and version-tag image builds explicitly, since tags pushed by its GITHUB_TOKEN do not trigger a second workflow. Local Docker builds and image-content checks passed (including synthetic secret files), the CLI still runs in the image, and this PR's Linux CI is green. We have not published an image yet; generated GHCR tags/digests still need verification when the publishing workflow first runs. |
Adds a GitHub Actions workflow to build and publish the Docker image to GHCR.
The workflow publishes
ghcr.io/${{ github.repository }}:lateston the default branch, plus branch/tag/SHA tags, using Docker Buildx and GitHub Actions cache.