6666 OUTPUT_SHORT_SHA : ${{ needs.prepare-env.outputs.output_short_sha }}
6767 OUTPUT_IMAGE_NAME : ${{ needs.prepare-env.outputs.output_image_name }}
6868 with :
69+ context : .
6970 push : false
7071 platforms : linux/amd64
7172 # we're building the container before the scan, use the short sha tag
@@ -82,12 +83,12 @@ jobs:
8283 OUTPUT_IMAGE_NAME : ${{ needs.prepare-env.outputs.output_image_name }}
8384 with :
8485 # here we use the local tag that we've built before
85- image-ref : ' ${{ env.OUTPUT_IMAGE_NAME }}:${{ env.OUTPUT_SHORT_SHA }}'
86- format : ' table'
86+ image-ref : " ${{ env.OUTPUT_IMAGE_NAME }}:${{ env.OUTPUT_SHORT_SHA }}"
87+ format : " table"
8788 # exit-code: '1' # uncomment to stop the CI if the scanner fails
8889 ignore-unfixed : true
89- vuln-type : ' os,library'
90- severity : ' CRITICAL,HIGH'
90+ vuln-type : " os,library"
91+ severity : " CRITICAL,HIGH"
9192
9293 docker-build :
9394 runs-on : " ubuntu-latest"
@@ -125,7 +126,7 @@ jobs:
125126tags : |
126127 # output minimal (short sha)
127128 type=raw,value={{sha}}
128- # output v0.2.1/v*-*
129+ # output v0.2.1/v*-* (or sha of no tag)
129130 type=semver,pattern={{raw}}
130131 # pull request event
131132 type=ref,enable=true,prefix=pr-,suffix=,event=pr
@@ -134,20 +135,50 @@ jobs:
134135 - name : Set up Docker Buildx
135136 uses : docker/setup-buildx-action@v2
136137
137- # We always build the image but we only push if we are on the `main`,
138- # `master` branch or a versioned `v*` branch
139- - name : Build and PushDocker Image
138+ # Build amd64 images always, and publish when it is not a fork. The Github
139+ # security model prevents forks from pushing to the registry so we can
140+ # only push if the branch/PR is not generated from a fork. Even though
141+ # forks can't push, we still want to try and build the image to catch
142+ # bugs. For testing purposes we only need an amd64 image.
143+ - name : Build and Push Docker Image amd64
140144 uses : docker/build-push-action@v4
141145 env :
142146 OUTPUT_SHORT_SHA : ${{ needs.prepare-env.outputs.output_short_sha }}
143147 OUTPUT_IMAGE_NAME : ${{ needs.prepare-env.outputs.output_image_name }}
144148 with :
145- platforms : linux/amd64,linux/arm64
149+ context : .
150+ platforms : linux/amd64
151+ # Only push if the head and base repos match, meaning it is not a fork
146152 # yamllint disable
147- # The following line, is execute as an if statement, only push when
148- # the branch is main, master or starts with v*
149- push : ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v') }}
153+ push : ${{ github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name }}
150154 # yamllint enable
151155 tags : ${{ steps.meta.outputs.tags }}
152156 labels : ${{ steps.meta.outputs.labels }}
153157 file : ${{ inputs.dockerfile }}
158+
159+ # Build and Publish images on main, master, and versioned branches.
160+ #
161+ # NOTES:
162+ # This step overrides the tag from the previous step. It will re-use
163+ # the cached image that was built and only build the remaining images.
164+ #
165+ # The reason we split out these steps into 2 is for better handling of
166+ # forks when building amd64 images and to enable faster availability of
167+ # the amd64 image since building the arm64 image takes significantly
168+ # longer.
169+ - name : Build and Push Docker Images
170+ uses : docker/build-push-action@v4
171+ # yamllint disable
172+ # only run when the branch is main, master or starts with v*
173+ if : ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v') }}
174+ # yamllint enable
175+ env :
176+ OUTPUT_SHORT_SHA : ${{ needs.prepare-env.outputs.output_short_sha }}
177+ OUTPUT_IMAGE_NAME : ${{ needs.prepare-env.outputs.output_image_name }}
178+ with :
179+ context : .
180+ platforms : linux/amd64,linux/arm64
181+ push : true
182+ tags : ${{ steps.meta.outputs.tags }}
183+ labels : ${{ steps.meta.outputs.labels }}
184+ file : ${{ inputs.dockerfile }}
0 commit comments