build(deps): update images digests (main) #19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Buildenv Package Diff | |
| on: | |
| # When a PR bumps the kernel-buildenv digest pin (normally dependabot), show | |
| # what actually changed between the two images: each image carries its own | |
| # package manifest at /usr/share/buildenv/packages.tsv, so the diff is just | |
| # two pulls and a compare, posted to the check summary for the reviewer. | |
| pull_request: | |
| paths: | |
| - "Dockerfile" | |
| permissions: | |
| contents: read | |
| packages: read | |
| jobs: | |
| diff: | |
| name: package diff | |
| runs-on: | |
| group: Self Hosted | |
| labels: edera-16 | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 | |
| with: | |
| egress-policy: audit | |
| - name: checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 | |
| - name: docker login ghcr.io | |
| uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0 | |
| with: | |
| action: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 | |
| with: | | |
| registry: ghcr.io | |
| username: "${{github.actor}}" | |
| password: "${{secrets.GITHUB_TOKEN}}" | |
| - name: diff package manifests | |
| run: | | |
| extract_ref() { | |
| grep -oE 'ghcr\.io/edera-dev/kernel-buildenv[^[:space:]]*@sha256:[0-9a-f]+' "$1" | head -1 || true | |
| } | |
| git fetch --depth 1 origin "${{ github.base_ref }}" | |
| git show FETCH_HEAD:Dockerfile > Dockerfile.base 2>/dev/null || : > Dockerfile.base | |
| OLD_REF="$(extract_ref Dockerfile.base)" | |
| NEW_REF="$(extract_ref Dockerfile)" | |
| if [ -z "${NEW_REF}" ] || [ "${OLD_REF}" = "${NEW_REF}" ]; then | |
| echo "kernel-buildenv pin unchanged; nothing to diff" | |
| exit 0 | |
| fi | |
| MANIFEST=/usr/share/buildenv/packages.tsv | |
| docker run --rm "${NEW_REF}" cat "${MANIFEST}" > packages-new.tsv | |
| { | |
| echo "## kernel-buildenv package changes" | |
| echo "" | |
| } >> "${GITHUB_STEP_SUMMARY}" | |
| if [ -z "${OLD_REF}" ]; then | |
| { | |
| echo "New pin \`${NEW_REF}\` (no previous pin to diff against);" | |
| echo "$(wc -l < packages-new.tsv) packages in the image." | |
| } >> "${GITHUB_STEP_SUMMARY}" | |
| exit 0 | |
| fi | |
| docker run --rm "${OLD_REF}" cat "${MANIFEST}" > packages-old.tsv | |
| { | |
| echo "\`${OLD_REF}\`" | |
| echo "→ \`${NEW_REF}\`" | |
| echo "" | |
| if diff -u packages-old.tsv packages-new.tsv > packages.diff; then | |
| echo "No package version changes (image metadata/base layer only)." | |
| else | |
| echo '```diff' | |
| # Skip the +++/--- header noise; keep only the package changes. | |
| grep -E '^[+-][^+-]' packages.diff | |
| echo '```' | |
| fi | |
| } >> "${GITHUB_STEP_SUMMARY}" |