Skip to content

Fix weekly rebuild #101

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
carole-lavillonniere wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Fix weekly rebuild #101

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0f7e5fc
Cut a GitHub release from the rebuild, and pin the release workflow
carole-lavillonniere Sep 2, 2026
a9e8459
Merge branch 'main' into cosy-926-release-visibility
carole-lavillonniere Sep 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions .github/workflows/build-push-docker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,23 +20,23 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Download binaries
run: bash downloadBinaries.sh

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

- name: Login to Docker Hub
uses: docker/login-action@v4
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}

- name: Extract Docker metadata
id: meta
uses: docker/metadata-action@v6
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
with:
images: localstack/localstack-docker-desktop
tags: |
Expand All @@ -46,7 +46,7 @@ jobs:
type=sha

- name: Build and push Docker image
uses: docker/build-push-action@v7
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: .
file: "./Dockerfile"
Expand Down
22 changes: 16 additions & 6 deletions .github/workflows/security-rebuild.yml
View file
Open in desktop

@Pive01 Pive01 Sep 2, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Question: now though wouldn't build-push-docker.yml get triggered again and try to push a tag that has already been published by the Publish (multi-arch) step?

Original file line number Diff line number Diff line change
Expand Up @@ -147,23 +147,33 @@ jobs:

- name: Publish (multi-arch)
# Published here rather than via build-push-docker.yml: GITHUB_TOKEN pushes don't trigger workflows.
# v${NEW} is what the secops scan resolves; latest is what docker pull and the marketplace read.
if: steps.delta.outputs.cleared == 'true' && !inputs.dry_run
env:
NEW: ${{ steps.bump.outputs.version }}
run: |
echo "Publishing ${PUBLISHED_IMAGE}:${NEW}, clearing:"; cat cleared.txt
echo "Publishing ${PUBLISHED_IMAGE}:${NEW} (also v${NEW}, latest), clearing:"; cat cleared.txt
docker buildx build --push --pull --no-cache \
--platform "${PLATFORMS}" \
--tag "${PUBLISHED_IMAGE}:${NEW}" .
--tag "${PUBLISHED_IMAGE}:${NEW}" \
--tag "${PUBLISHED_IMAGE}:v${NEW}" \
--tag "${PUBLISHED_IMAGE}:latest" .

# After the publish on purpose: a failed publish must not leave TAG pointing at an unpushed image.
- name: Commit and tag
- name: Commit, tag and release
if: steps.delta.outputs.cleared == 'true' && !inputs.dry_run
env:
NEW: ${{ steps.bump.outputs.version }}
GH_TOKEN: ${{ github.token }}
run: |
git add Makefile Dockerfile CHANGELOG.md
git commit -m "Security rebuild ${{ steps.bump.outputs.version }}"
git tag "v${{ steps.bump.outputs.version }}"
git push origin HEAD:main "v${{ steps.bump.outputs.version }}"
git commit -m "Security rebuild ${NEW}"
git tag "v${NEW}"
git push origin HEAD:main "v${NEW}"

# The secops scan reads our GitHub releases, not our tags; a bare tag leaves it on the old version.
gh release create "v${NEW}" --title "${NEW}" \
--notes "Weekly security rebuild (COSY-926). Cleared: $(paste -sd', ' cleared.txt)."

- name: Summary
if: always()
Expand Down