Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 14 additions & 44 deletions .github/actions/build-push-image/action.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,15 @@ outputs:
runs:
using: "composite"
steps:
- name: Build image metadata
uses: ./.github/actions/metadata
id: meta
with:
platforms: ${{ inputs.platforms }}
annotation: ${{ inputs.annotation }}
dockerfile: ${{ inputs.dockerfile }}
images: ${{ inputs.images }}
suffix: ${{ inputs.suffix }}
- name: Set up QEMU
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
- name: Set up Docker Buildx
Expand All @@ -32,62 +41,23 @@ runs:
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
with:
go-version-file: "${{ github.workspace }}/go.mod"
- name: Prepare build parameters
id: prep
shell: bash
run: |
hack/build/ci/prepare-build-variables.sh
- name: Download third party licenses
shell: bash
run: |
hack/build/ci/third-party-licenses.sh
- name: Set build date
- name: Prepare linker args
id: linker-args
shell: bash
id: set-build-date
run: |
echo "date=$(date --iso-8601)" >> $GITHUB_OUTPUT
- name: Docker metadata
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
id: meta
env:
DOCKER_METADATA_ANNOTATIONS_LEVELS: ${{ contains(inputs.platforms, ',') && 'manifest,index' || 'manifest' }}
with:
images: ${{ inputs.images }}
flavor: |
# prepend suffixes (like "fips") with a dash
suffix=${{ inputs.suffix != '' && format('-{0}', inputs.suffix) || '' }}
labels: |
# default retention policy
quay.expires-after=10d
# releases and snapshots of the main branch should never expire
${{ ((github.ref_type == 'tag' && startsWith(github.ref_name, 'release-')) || github.ref_name == 'main') && 'quay.expires-after=' }}
# retention policy for nightly builds
${{ github.event_name == 'schedule' && 'quay.expires-after=14d' }}
vcs-ref=${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
build-date=${{ steps.set-build-date.outputs.date }}
tags: |
# PRs
type=raw,value=snapshot-${{ github.head_ref }},enable=${{ github.event_name == 'pull_request' }}
# main branches (not including nightly builds)
type=raw,value=snapshot,enable=${{ github.ref_name == 'main' && github.event_name != 'schedule' }}
# nightly builds
type=raw,value=nightly-${{ steps.set-build-date.outputs.date }},enable=${{ github.event_name == 'schedule' }}
type=raw,value=nightly,enable=${{ github.event_name == 'schedule' }}
# tags
type=raw,value=${{ github.ref_name }},enable=${{ github.ref_type == 'tag' }}
# all other branches including 'release-*' branches except 'main'
type=raw,value=${{ steps.prep.outputs.docker_image_tag_without_prefix }},enable=${{ !(github.event_name == 'pull_request' || github.ref_name == 'main' || github.ref_type == 'tag') }},priority=0
annotations: |
${{ inputs.annotation }}
version=${{ github.event_name == 'pull_request' && github.head_ref || github.ref_name }}
go_linker_args=$(hack/build/create_go_linker_args.sh "${{ steps.meta.outputs.tag-names }}" "${{ github.sha }}")
Copy link

Copilot AI Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The create_go_linker_args.sh script is being passed tag-names (which contains multiple comma-separated tags without the image base name) instead of a single tag value. The original code passed docker_image_tag from create_docker_image_tag(), which was a single tag string. This may cause the linker args script to fail or produce incorrect version information.

Suggested change
go_linker_args=$(hack/build/create_go_linker_args.sh "${{ steps.meta.outputs.tag-names }}" "${{ github.sha }}")
go_linker_args=$(hack/build/create_go_linker_args.sh "${{ steps.meta.outputs.tag }}" "${{ github.sha }}")

Copilot uses AI. Check for mistakes.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

create_go_linker_args.sh script needs tag without the image base name so it should be value of tag-names .

echo "go_linker_args=${go_linker_args}" >> $GITHUB_OUTPUT
- name: Build target
id: build-target
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
with:
builder: ${{ steps.buildx.outputs.name }}
build-args: |
GO_LINKER_ARGS=${{ steps.prep.outputs.go_linker_args }}
GO_BUILD_TAGS=${{ steps.prep.outputs.go_build_tags }}
GO_LINKER_ARGS=${{ steps.linker-args.outputs.go_linker_args }}
context: .
file: ${{ inputs.dockerfile }}
provenance: false
Expand Down
93 changes: 93 additions & 0 deletions .github/actions/metadata/action.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,93 @@
name: Build image metadata
description: Builds image metadata
inputs:
platforms:
description: The platforms for which the image will be built
default: linux/amd64,linux/arm64
required: true
annotation:
description: The annotation added to the built image
required: false
dockerfile:
description: The path to the Dockerfile to be used
default: ./Dockerfile
images:
description: Base names of the image tags
required: false
suffix:
description: Suffix appended to image tags
required: false
outputs:
annotations:
description: Annotations of the image
value: ${{ steps.meta.outputs.annotations }}
labels:
description: Labels of the image
value: ${{ steps.meta.outputs.labels }}
tags:
description: Tags of the image
value: ${{ steps.meta.outputs.tags }}
tag-names:
description: Tag-names of the image
value: ${{ steps.meta.outputs.tag-names }}
runs:
using: "composite"
steps:
- name: Sanitize names
id: sanitize
shell: bash
run: |
# Sanitize names
ref_name=$(hack/build/ci/sanitize-branch-name.sh "${{ github.ref_name }}")
echo "ref_name=${ref_name}" >> $GITHUB_OUTPUT
echo "ref_name_without_prefix=${ref_name#v}" >> $GITHUB_OUTPUT

head_ref=$(hack/build/ci/sanitize-branch-name.sh "${{ github.head_ref }}")
echo "head_ref=${head_ref}" >> $GITHUB_OUTPUT
- name: Set build date
shell: bash
id: set-build-date
run: |
# Set build date
echo "date=$(date --iso-8601)" >> $GITHUB_OUTPUT
- name: Docker metadata
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
id: meta
env:
DOCKER_METADATA_ANNOTATIONS_LEVELS: ${{ contains(inputs.platforms, ',') && 'manifest,index' || 'manifest' }}
with:
images: ${{ inputs.images }}
flavor: |
# prepend suffixes (like "fips") with a dash
suffix=${{ inputs.suffix != '' && format('-{0}', inputs.suffix) || '' }}
labels: |
# default retention policy
quay.expires-after=10d

# releases and snapshots of the main branch should never expire
${{ ((github.ref_type == 'tag' && startsWith(github.ref_name, 'release-')) || github.ref_name == 'main') && 'quay.expires-after=' }}

# retention policy for nightly builds
${{ github.event_name == 'schedule' && 'quay.expires-after=14d' }}

vcs-ref=${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
build-date=${{ steps.set-build-date.outputs.date }}
tags: |
# PRs
type=raw,value=snapshot-${{ steps.sanitize.outputs.head_ref }},enable=${{ github.event_name == 'pull_request' }}

# main branches (not including nightly builds)
type=raw,value=snapshot,enable=${{ github.ref_name == 'main' && github.event_name != 'schedule' }}

# nightly builds
type=raw,value=nightly-${{ steps.set-build-date.outputs.date }},enable=${{ github.event_name == 'schedule' }}
type=raw,value=nightly,enable=${{ github.event_name == 'schedule' }}

# tags
type=raw,value=${{ steps.sanitize.outputs.ref_name }},enable=${{ github.ref_type == 'tag' }}

# all other branches including 'release-*' branches except 'main'
type=raw,value=snapshot-${{ steps.sanitize.outputs.ref_name }},enable=${{ !(github.event_name == 'pull_request' || github.ref_name == 'main' || github.ref_type == 'tag') }},priority=0
annotations: |
${{ inputs.annotation }}
version=${{ github.event_name == 'pull_request' && github.head_ref || github.ref_name }}
23 changes: 13 additions & 10 deletions .github/actions/preflight/action.yaml
Original file line number Diff line number Diff line change
@@ -1,15 +1,13 @@
name: Preflight
description: Does the preflight check
inputs:
version:
description: The version the image is for
required: true
registry:
description: The registry where the image is uploaded
required: true
repository:
description: The repository in the registry where the image is uploaded
platforms:
description: The platforms for which the image will be built
default: linux/amd64,linux/arm64
required: true
images:
description: Base names of the image tags
required: false
report-name:
description: The name of the output report
required: true
Expand All @@ -27,16 +25,21 @@ inputs:
runs:
using: "composite"
steps:
- name: Build image metadata
uses: ./.github/actions/metadata
id: meta
with:
platforms: ${{ inputs.platforms }}
images: ${{ inputs.images }}
- name: Run preflight on image
shell: bash
env:
RHCC_APITOKEN: ${{ inputs.pyxis-api-token }}
RHCC_PROJECT_ID: ${{ inputs.redhat-project-id }}
# renovate datasource=github-releases depName=redhat-openshift-ecosystem/openshift-preflight
PREFLIGHT_VERSION: 1.15.2
IMAGE_URI: ${{ inputs.registry }}/${{ inputs.repository }}:${{ inputs.version }}
run: |
hack/build/ci/preflight.sh "${{ env.PREFLIGHT_VERSION }}" "${{ env.IMAGE_URI}}" "${{ inputs.report-name }}" "${{ inputs.should-submit }}"
hack/build/ci/preflight.sh "${{ env.PREFLIGHT_VERSION }}" "${{ steps.meta.outputs.tags }}" "${{ inputs.report-name }}" "${{ inputs.should-submit }}"
- name: Upload report
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
with:
Expand Down
23 changes: 3 additions & 20 deletions .github/workflows/ci.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -261,22 +261,6 @@ jobs:
- name: Check markdown links
run: make markdown/link-check

prepare:
name: Prepare properties
needs: [detect-changes]
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
runs-on: ubuntu-24.04
steps:
- name: Checkout
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
- name: Prepare build parameters
id: prep
run: |
hack/build/ci/prepare-build-variables.sh
outputs:
labels: ${{ steps.prep.outputs.docker_image_labels }}
version: ${{ steps.prep.outputs.docker_image_tag }}

build-push:
needs: [detect-changes]
if: needs.detect-changes.outputs.is_docker_authorized && (needs.detect-changes.outputs.is_protected_branch || needs.detect-changes.outputs.go_changed || needs.detect-changes.outputs.docker_changed || needs.detect-changes.outputs.ci_changed)
Expand All @@ -301,7 +285,7 @@ jobs:
name: Run preflight on quay.io without submitting results when merging to main
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
environment: Release
needs: [build-push, prepare]
needs: [build-push]
runs-on: ubuntu-24.04
env:
SCAN_REGISTRY: "quay.io"
Expand All @@ -311,8 +295,7 @@ jobs:
- name: Run preflight
uses: ./.github/actions/preflight
with:
version: ${{ needs.prepare.outputs.version }}
registry: ${{ env.DOCKER_REGISTRY }}
repository: ${{ env.DOCKER_REPOSITORY }}
platforms: ${{github.ref_protected && env.PLATFORMS || env.PR_PLATFORMS }}
images: ${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_REPOSITORY }}
report-name: "preflight.json"
should-submit: "false"
15 changes: 1 addition & 14 deletions hack/build/ci/prepare-build-variables.sh
Original file line number Diff line number Diff line change
Expand Up @@ -20,23 +20,10 @@ create_docker_image_tag() {
echo "snapshot-${ref_name}"
}

create_docker_image_labels() {
if [[ "${GITHUB_REF_TYPE}" != "tag" ]] && [[ ! "${GITHUB_REF_NAME}" =~ ^release-* ]] && [[ "${GITHUB_REF_NAME}" != "main" ]]; then
echo "quay.expires-after=10d"
fi

echo "build-date=$(date --iso-8601)"
echo "vcs-ref=${GITHUB_SHA}"
}

print_build_variables() {
local docker_image_tag docker_image_labels go_linker_args
local docker_image_tag
docker_image_tag=$(create_docker_image_tag)
docker_image_labels=$(create_docker_image_labels)
go_linker_args=$(hack/build/create_go_linker_args.sh "${docker_image_tag}" "${GITHUB_SHA}")

echo "go_linker_args=${go_linker_args}"
echo "docker_image_labels=${docker_image_labels}"
echo "docker_image_tag=${docker_image_tag}"
echo "docker_image_tag_without_prefix=${docker_image_tag#v}"
}
Expand Down