From 023f74d20f35493ba5ba569c2f32d22e98d9516f Mon Sep 17 00:00:00 2001 From: Piyush Pritam Sethi Date: Mon, 1 Jun 2026 10:13:23 +0530 Subject: [PATCH 1/4] Fix repository name casing for GHCR, pin base image, and add input validation --- .github/workflows/build-image.yml | 26 +++++++++++++++++++++++--- .github/workflows/release.yml | 21 ++++++++++++++++++++- images/bpy/Dockerfile | 2 +- 3 files changed, 44 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml index 2c872bd..1e7548e 100644 --- a/.github/workflows/build-image.yml +++ b/.github/workflows/build-image.yml @@ -11,6 +11,11 @@ on: required: true type: string description: "Docker tag, e.g. latest or 1.2.3" + push_latest: + required: false + type: boolean + default: true + description: "Whether to tag and push the image as latest" jobs: build-and-push: @@ -26,6 +31,23 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} + - name: Lowercase repo name + id: repo + run: | + echo "names_lowercase=$(echo "$GITHUB_REPOSITORY" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT + + - name: Generate tags + id: tags + run: | + TAGS="ghcr.io/${{ steps.repo.outputs.names_lowercase }}/${{ inputs.image_name }}:${{ inputs.tag }}" + if [ "${{ inputs.push_latest }}" = "true" ]; then + TAGS="${TAGS} + ghcr.io/${{ steps.repo.outputs.names_lowercase }}/${{ inputs.image_name }}:latest" + fi + echo "docker_tags<> $GITHUB_OUTPUT + echo "$TAGS" >> $GITHUB_OUTPUT + echo "EOF" >> $GITHUB_OUTPUT + - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 @@ -34,8 +56,6 @@ jobs: with: context: images/${{ inputs.image_name }} push: true - tags: | - ghcr.io/${{ github.repository }}/${{ inputs.image_name }}:${{ inputs.tag }} - ghcr.io/${{ github.repository }}/${{ inputs.image_name }}:latest + tags: ${{ steps.tags.outputs.docker_tags }} cache-from: type=gha cache-to: type=gha,mode=max diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5083eaa..1704ced 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -16,6 +16,11 @@ on: description: "Tag to push (e.g. 1.2.3)" required: true type: string + push_latest: + description: "Tag and push as latest" + required: true + type: boolean + default: true permissions: contents: read @@ -27,20 +32,33 @@ jobs: outputs: image_name: ${{ steps.parse.outputs.image_name }} tag: ${{ steps.parse.outputs.tag }} + push_latest: ${{ steps.parse.outputs.push_latest }} steps: - - name: Parse tag or inputs + - name: Checkout repo + uses: actions/checkout@v4 + + - name: Parse tag or inputs and validate id: parse run: | if [ "${{ github.event_name }}" = "push" ]; then REF="${{ github.ref_name }}" # e.g. bpy/v1.2.3 IMAGE="${REF%%/*}" # bpy TAG="${REF##*/v}" # 1.2.3 + PUSH_LATEST="true" else IMAGE="${{ inputs.image_name }}" TAG="${{ inputs.tag }}" + PUSH_LATEST="${{ inputs.push_latest }}" fi + + if [ ! -f "images/$IMAGE/Dockerfile" ]; then + echo "::error::Dockerfile not found at images/$IMAGE/Dockerfile. Please check your image name." + exit 1 + fi + echo "image_name=$IMAGE" >> $GITHUB_OUTPUT echo "tag=$TAG" >> $GITHUB_OUTPUT + echo "push_latest=$PUSH_LATEST" >> $GITHUB_OUTPUT build: needs: parse-tag @@ -49,3 +67,4 @@ jobs: with: image_name: ${{ needs.parse-tag.outputs.image_name }} tag: ${{ needs.parse-tag.outputs.tag }} + push_latest: ${{ needs.parse-tag.outputs.push_latest == 'true' }} diff --git a/images/bpy/Dockerfile b/images/bpy/Dockerfile index 237adc1..1c29a7f 100644 --- a/images/bpy/Dockerfile +++ b/images/bpy/Dockerfile @@ -1,4 +1,4 @@ -FROM ghcr.io/catthehacker/ubuntu:act-latest +FROM ghcr.io/catthehacker/ubuntu:act-22.04 ENV DEBIAN_FRONTEND=noninteractive From 368ad872f5b72e91777bea60ab40db9004115942 Mon Sep 17 00:00:00 2001 From: Piyush Pritam Sethi Date: Mon, 1 Jun 2026 10:15:24 +0530 Subject: [PATCH 2/4] Fix leading whitespace in multiline docker tags --- .github/workflows/build-image.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml index 1e7548e..800e953 100644 --- a/.github/workflows/build-image.yml +++ b/.github/workflows/build-image.yml @@ -41,8 +41,7 @@ jobs: run: | TAGS="ghcr.io/${{ steps.repo.outputs.names_lowercase }}/${{ inputs.image_name }}:${{ inputs.tag }}" if [ "${{ inputs.push_latest }}" = "true" ]; then - TAGS="${TAGS} - ghcr.io/${{ steps.repo.outputs.names_lowercase }}/${{ inputs.image_name }}:latest" + TAGS="${TAGS}"$'\n'"ghcr.io/${{ steps.repo.outputs.names_lowercase }}/${{ inputs.image_name }}:latest" fi echo "docker_tags<> $GITHUB_OUTPUT echo "$TAGS" >> $GITHUB_OUTPUT From 5c2f8417a9d8cfbc4b65fad0c7449d50510b6035 Mon Sep 17 00:00:00 2001 From: Piyush Pritam Sethi Date: Mon, 1 Jun 2026 10:18:15 +0530 Subject: [PATCH 3/4] Quote GHA expressions to resolve YAML parsing syntax warnings --- .github/workflows/build-image.yml | 2 +- .github/workflows/release.yml | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml index 800e953..e7a4132 100644 --- a/.github/workflows/build-image.yml +++ b/.github/workflows/build-image.yml @@ -55,6 +55,6 @@ jobs: with: context: images/${{ inputs.image_name }} push: true - tags: ${{ steps.tags.outputs.docker_tags }} + tags: "${{ steps.tags.outputs.docker_tags }}" cache-from: type=gha cache-to: type=gha,mode=max diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1704ced..face386 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -30,9 +30,9 @@ jobs: parse-tag: runs-on: ubuntu-latest outputs: - image_name: ${{ steps.parse.outputs.image_name }} - tag: ${{ steps.parse.outputs.tag }} - push_latest: ${{ steps.parse.outputs.push_latest }} + image_name: "${{ steps.parse.outputs.image_name }}" + tag: "${{ steps.parse.outputs.tag }}" + push_latest: "${{ steps.parse.outputs.push_latest }}" steps: - name: Checkout repo uses: actions/checkout@v4 @@ -65,6 +65,6 @@ jobs: uses: ./.github/workflows/build-image.yml secrets: inherit with: - image_name: ${{ needs.parse-tag.outputs.image_name }} - tag: ${{ needs.parse-tag.outputs.tag }} - push_latest: ${{ needs.parse-tag.outputs.push_latest == 'true' }} + image_name: "${{ needs.parse-tag.outputs.image_name }}" + tag: "${{ needs.parse-tag.outputs.tag }}" + push_latest: "${{ needs.parse-tag.outputs.push_latest == 'true' }}" From 8c29d74fadaca867cd4669061448b7a94964597a Mon Sep 17 00:00:00 2001 From: Piyush Pritam Sethi Date: Mon, 1 Jun 2026 10:21:57 +0530 Subject: [PATCH 4/4] Quote remaining credentials expressions in build-image workflow to resolve syntax warnings --- .github/workflows/build-image.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml index e7a4132..a54fe0c 100644 --- a/.github/workflows/build-image.yml +++ b/.github/workflows/build-image.yml @@ -28,8 +28,8 @@ jobs: uses: docker/login-action@v3 with: registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + username: "${{ github.actor }}" + password: "${{ secrets.GITHUB_TOKEN }}" - name: Lowercase repo name id: repo