update registry to quay#1659
Open
nikhilsinhaparseable wants to merge 1 commit into
Open
Conversation
Contributor
WalkthroughFour GitHub Actions workflows are migrated from Docker Hub to Quay for container image publishing. Each workflow replaces Docker Hub authentication with Quay credentials and updates metadata generation and build-push image targets to ChangesContainer Registry Migration
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-push-edge-debug.yaml:
- Line 29: The workflow uses mutable tags docker/login-action@v3 and
docker/metadata-action@v5 which should be pinned to immutable commit SHAs;
locate the uses of "docker/login-action@v3" and "docker/metadata-action@v5" in
the workflow and replace each "`@vX`" tag with the corresponding full commit SHA
from the action's upstream GitHub repo (e.g., docker/login-action@<commit-sha>
and docker/metadata-action@<commit-sha>), ensuring you fetch the correct latest
stable commit SHAs from their official repositories and update both occurrences
in the file.
In @.github/workflows/build-push-edge-kafka.yaml:
- Line 29: The workflow currently pins actions by tag ("docker/login-action@v3"
and "docker/metadata-action@v5") which can change; replace those tag pins with
the corresponding immutable commit SHAs for docker/login-action and
docker/metadata-action in the workflow file so the steps use fixed SHAs (e.g.,
change docker/login-action@v3 -> docker/login-action@<commit-sha> and
docker/metadata-action@v5 -> docker/metadata-action@<commit-sha>), updating the
two uses: the step referencing docker/login-action and the step referencing
docker/metadata-action to their SHA-pinned versions.
In @.github/workflows/build-push-edge.yaml:
- Line 29: Replace the mutable tags for the actions to pinned commit SHAs:
locate the uses entries for docker/login-action@v3 and docker/metadata-action@v5
in the workflow and replace their `@v`* tags with the corresponding full commit
SHA refs for docker/login-action and docker/metadata-action respectively; update
the two uses lines so they reference the exact commit SHAs (keep the same action
names docker/login-action and docker/metadata-action to find the lines).
In @.github/workflows/release.yml:
- Line 365: The workflow uses mutable action tags (docker/login-action@v3,
docker/metadata-action@v5, docker/build-push-action@v6); replace each occurrence
with the corresponding immutable commit SHA for that action repository (e.g.,
docker/login-action@<commit-sha>) to SHA-pin the actions, ensuring you update
all instances of docker/login-action, docker/metadata-action, and
docker/build-push-action in the file to their latest verified commit SHAs and
commit the change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 665da25c-2d7c-4376-8a7d-729168a42680
📒 Files selected for processing (4)
.github/workflows/build-push-edge-debug.yaml.github/workflows/build-push-edge-kafka.yaml.github/workflows/build-push-edge.yaml.github/workflows/release.yml
|
|
||
| - name: Login to Docker Hub | ||
| - name: Login to Quay | ||
| uses: docker/login-action@v3 |
Contributor
There was a problem hiding this comment.
Pin third-party GitHub Actions to full commit SHAs (no mutable @v* tags)
In .github/workflows/build-push-edge-debug.yaml, docker/login-action@v3 (line 29) and docker/metadata-action@v5 (line 37) use mutable version tags; pin both to full commit SHAs for stronger CI supply-chain integrity.
🔒 Suggested fix
- uses: docker/login-action@v3
+ uses: docker/login-action@<full-commit-sha>
- uses: docker/metadata-action@v5
+ uses: docker/metadata-action@<full-commit-sha>🧰 Tools
🪛 zizmor (1.25.2)
[error] 29-29: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-push-edge-debug.yaml at line 29, The workflow uses
mutable tags docker/login-action@v3 and docker/metadata-action@v5 which should
be pinned to immutable commit SHAs; locate the uses of "docker/login-action@v3"
and "docker/metadata-action@v5" in the workflow and replace each "`@vX`" tag with
the corresponding full commit SHA from the action's upstream GitHub repo (e.g.,
docker/login-action@<commit-sha> and docker/metadata-action@<commit-sha>),
ensuring you fetch the correct latest stable commit SHAs from their official
repositories and update both occurrences in the file.
|
|
||
| - name: Login to Docker Hub | ||
| - name: Login to Quay | ||
| uses: docker/login-action@v3 |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/build-push-edge-kafka.yaml"
echo "== File: $FILE =="
if [ ! -f "$FILE" ]; then
echo "Missing file: $FILE"
exit 1
fi
# Print with line numbers around the referenced lines
nl -ba "$FILE" | sed -n '1,140p'
# Extract only the uses lines for docker/login-action and docker/metadata-action
echo "== Matching uses lines =="
rg -n "uses:\s*docker/(login-action|metadata-action)@" "$FILE" || trueRepository: parseablehq/parseable
Length of output: 184
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/build-push-edge-kafka.yaml"
echo "== File: $FILE =="
if [ ! -f "$FILE" ]; then
echo "Missing file: $FILE"
exit 1
fi
echo "== Line-numbered excerpt (1-120) =="
awk '{printf "%4d\t%s\n", NR, $0}' "$FILE" | sed -n '1,120p'
echo "== Matching uses lines =="
rg -n "uses:\s*docker/(login-action|metadata-action)@" "$FILE" || trueRepository: parseablehq/parseable
Length of output: 2189
Pin GitHub Actions references to immutable SHAs
Line 29 (docker/login-action@v3) and line 37 (docker/metadata-action@v5) are still tag-pinned instead of SHA-pinned.
🔒 Suggested fix
- uses: docker/login-action@v3
+ uses: docker/login-action@<full-commit-sha>
- uses: docker/metadata-action@v5
+ uses: docker/metadata-action@<full-commit-sha>🧰 Tools
🪛 zizmor (1.25.2)
[error] 29-29: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-push-edge-kafka.yaml at line 29, The workflow
currently pins actions by tag ("docker/login-action@v3" and
"docker/metadata-action@v5") which can change; replace those tag pins with the
corresponding immutable commit SHAs for docker/login-action and
docker/metadata-action in the workflow file so the steps use fixed SHAs (e.g.,
change docker/login-action@v3 -> docker/login-action@<commit-sha> and
docker/metadata-action@v5 -> docker/metadata-action@<commit-sha>), updating the
two uses: the step referencing docker/login-action and the step referencing
docker/metadata-action to their SHA-pinned versions.
|
|
||
| - name: Login to Docker Hub | ||
| - name: Login to Quay | ||
| uses: docker/login-action@v3 |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/build-push-edge.yaml"
if [ ! -f "$FILE" ]; then
echo "Missing file: $FILE" >&2
exit 1
fi
nl -ba "$FILE" | sed -n '1,120p'
echo "---- uses lines ----"
rg -n "uses:\s*docker/(login-action|metadata-action)@" "$FILE" || trueRepository: parseablehq/parseable
Length of output: 108
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/build-push-edge.yaml"
if [ ! -f "$FILE" ]; then
echo "Missing file: $FILE" >&2
exit 1
fi
echo "---- matching uses lines (docker/login-action, docker/metadata-action) ----"
rg -n "uses:\s*docker/(login-action|metadata-action)@" "$FILE" || true
echo "---- lines 20-60 with numbers ----"
awk 'NR>=20 && NR<=60 {printf "%d:%s\n", NR, $0}' "$FILE"Repository: parseablehq/parseable
Length of output: 1281
Pin docker/login-action and docker/metadata-action to commit SHAs (mutable action tags at lines 29 and 37)
Workflow currently uses docker/login-action@v3 (line 29) and docker/metadata-action@v5 (line 37); replace @v* with full commit SHA refs to reduce supply-chain risk.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 29-29: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-push-edge.yaml at line 29, Replace the mutable tags
for the actions to pinned commit SHAs: locate the uses entries for
docker/login-action@v3 and docker/metadata-action@v5 in the workflow and replace
their `@v`* tags with the corresponding full commit SHA refs for
docker/login-action and docker/metadata-action respectively; update the two uses
lines so they reference the exact commit SHAs (keep the same action names
docker/login-action and docker/metadata-action to find the lines).
|
|
||
| - name: Login to Docker Hub | ||
| - name: Login to Quay | ||
| uses: docker/login-action@v3 |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate the workflow file
ls -la .github/workflows/release.yml
# Show relevant lines around the referenced actions
sed -n '340,420p' .github/workflows/release.yml | nl -ba
# Search for the exact docker actions mentioned
rg -n "docker/(login-action|metadata-action|build-push-action)@" .github/workflows/release.ymlRepository: parseablehq/parseable
Length of output: 206
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== File =="
ls -la .github/workflows/release.yml
echo "== Lines 340-420 =="
sed -n '340,420p' .github/workflows/release.yml
echo "== All docker action refs in this file =="
rg -n "docker/(login-action|metadata-action|build-push-action)@" .github/workflows/release.yml || trueRepository: parseablehq/parseable
Length of output: 2501
Harden the release pipeline by SHA-pinning Docker actions.
Lines 365 (docker/login-action@v3), 373 (docker/metadata-action@v5), and docker/build-push-action@v6 (lines 378, 387, 398) use mutable action tags; pin them to immutable commit SHAs to reduce supply-chain/compliance risk.
🔒 Suggested fix
- uses: docker/login-action@v3
+ uses: docker/login-action@<full-commit-sha>
- uses: docker/metadata-action@v5
+ uses: docker/metadata-action@<full-commit-sha>
- uses: docker/build-push-action@v6
+ uses: docker/build-push-action@<full-commit-sha>🧰 Tools
🪛 zizmor (1.25.2)
[error] 365-365: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 365, The workflow uses mutable action
tags (docker/login-action@v3, docker/metadata-action@v5,
docker/build-push-action@v6); replace each occurrence with the corresponding
immutable commit SHA for that action repository (e.g.,
docker/login-action@<commit-sha>) to SHA-pin the actions, ensuring you update
all instances of docker/login-action, docker/metadata-action, and
docker/build-push-action in the file to their latest verified commit SHAs and
commit the change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
quay.io/parseablehq/parseable) instead of Docker Hub for edge, edge-debug, edge-kafka, and release builds.