From ba8e90d4be7e1351e951272122a06413166b3eb6 Mon Sep 17 00:00:00 2001 From: libre-7 Date: Thu, 1 Oct 2026 12:40:53 -0600 Subject: [PATCH] fix(ci): pin OCI licenses label; make publish-free PR builds explicit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Found during post-merge verification of #28 — the merged image did NOT carry the F5 license fix. ## The bug The published image had `org.opencontainers.image.licenses = GPL-3.0` even though the Dockerfile says AGPL-3.0. `docker/metadata-action` infers the label from the GitHub repo's license and OVERRIDES the Dockerfile LABEL via its `labels:` input. Every other OCI label survived correctly; only `licenses` was replaced, because it is the one metadata-action derives automatically. So the F5 remediation from #28 was silently reverted in the artifact users actually pull, while the README and Dockerfile both claimed AGPL-3.0 — the exact mismatch finding F5 was about, reintroduced by the publishing path. Fix: declare it explicitly in the metadata-action `labels:` block, which wins over both the inference and the Dockerfile. ## Also: stop the build job going vacuously green on PRs Verified from run 36907154998 that on a `pull_request` event every publish step is skipped: ``` 5 skipped Log in to GHCR 6 success Build and push to GHCR <- push:false, published nothing 7 skipped Log in to Docker Hub 8 skipped Mirror tags to Docker Hub 9 skipped Verify Docker Hub manifest platforms ``` The job reports success having published nothing, so a green `build` badge on a PR is not evidence that registry publishing works. A "Report publishing scope" step now announces this in the run summary, so the signal is honest about what it did and did not do. Refs #28 --- .github/workflows/docker-publish.yml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 227db3f..7e1b7b5 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -163,6 +163,20 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + # This job publishes only on push. Every push/mirror step below is gated + # `if: github.event_name != 'pull_request'`, so on a PR the job would + # otherwise go green having published nothing — a false signal, since + # "Build and push" with push:false still reports success. Make the no-op + # explicit so a PR's green build job is honestly labelled. + - name: Report publishing scope + run: | + if [ "${{ github.event_name }}" = "pull_request" ]; then + echo "::notice title=PR build is publish-free::This run builds and smoke-tests only." + echo "Registry publishing and the cross-registry platform check are skipped on PRs." + else + echo "Push detected — this run publishes to GHCR and mirrors to Docker Hub." + fi + - name: Extract metadata id: meta uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 @@ -174,6 +188,16 @@ jobs: type=sha,format=short,prefix=sha- type=semver,pattern={{version}} type=semver,pattern={{major}}.{{minor}} + # metadata-action infers org.opencontainers.image.licenses from the + # GitHub repo's license and OVERRIDES the Dockerfile LABEL via + # `labels:`. The repo source is GPL-3.0, but the shipped image + # redistributes AGPL-3.0 binaries (simplex-chat, simplexmq), so the + # published image was advertising GPL-3.0 despite the Dockerfile + # saying AGPL-3.0. Pin it here so the published metadata matches + # the terms of the artifact. See README "Bundled third-party + # components". + labels: | + org.opencontainers.image.licenses=AGPL-3.0 - name: Set up Docker Buildx uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1