Repository navigation
chore: pin action.yml to an image digest instead of :latest - #15
Merged
Merged
Conversation
Previously action.yml always pulled ghcr.io/tvlsi/issueservice:latest regardless of which git ref/tag a consumer used, so @v1 was not an actual pin - any push to main (or the monthly rebuild) changed what every consumer ran, with no gate. Pins to the digest built from bb7f6fc (current main) so v1 becomes a real, immutable reference. Also updates the publish-image.yml usage recommendation from @main to @v1, with a note that future releases need a new digest bump.
There was a problem hiding this comment.
Pull request overview
This PR makes the repository’s Docker-based GitHub Action immutable by pinning the container image to a specific registry digest (instead of :latest), and updates the image publish workflow’s step summary to recommend using the stable major tag (@v1).
Changes:
- Pin
action.yml’sruns.imagetoghcr.io/tvlsi/issueservice@sha256:…rather than:latestto prevent un-gated behavior changes for consumers. - Update
.github/workflows/publish-image.ymlstep summary to recommendTVLSI/IssueService@v1(and add release/digest guidance text).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
action.yml |
Pins the action runtime image to an immutable digest instead of :latest. |
.github/workflows/publish-image.yml |
Updates the published-image step summary to recommend @v1 and explains digest/release implications. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+73
to
+74
| echo "Note: action.yml on the v1 tag pins to an image digest, not :latest." >> $GITHUB_STEP_SUMMARY | ||
| echo "This build alone does not change what @v1 consumers run — cut a new release and update action.yml's digest to ship it." >> $GITHUB_STEP_SUMMARY |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
action.yml'sruns.imagewas hardcoded todocker://ghcr.io/tvlsi/issueservice:latest, so even consumers pinned to@v1actually ran whatever:latestwas at execution time — any push to main (or the monthly rebuild) changed behavior for everyone with no gate.bb7f6fc), making@v1an actual immutable reference.publish-image.yml's step summary from@mainto@v1, with a note that future releases require bumping the digest.Test plan
bb7f6fcviadocker pull+docker inspectpublish-image.yml's rebuild triggers (Dockerfile/requirements.txt/entrypoint.sh/workflow paths) are unaffected by this change, so this won't cause an unexpected rebuild