Repository navigation

image

fix(security): Remove unsafe PR head checkout in pull_request_target workflow #1334

	name: image

	on:
	pull_request:
	push:
	branches: [master, release/*, test-me-]

	jobs:
	image:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	packages: write
	steps:
	- uses: actions/checkout@v6
	- name: builder-image
	run: \|
	set -euxo pipefail

	img=ghcr.io/getsentry/craft-builder:latest
	args=()
	if docker pull -q "$img"; then
	args+=(--cache-from "$img")
	fi
	docker buildx build \
	"${args[@]}" \
	--build-arg BUILDKIT_INLINE_CACHE=1 \
	--target builder \
	--tag "$img" \
	.
	- name: image
	run: \|
	set -euxo pipefail

	img=ghcr.io/getsentry/craft:latest
	args=()
	if docker pull -q "$img"; then
	args+=(--cache-from "$img")
	fi
	docker buildx build \
	"${args[@]}" \
	--build-arg "SOURCE_COMMIT=$GITHUB_SHA" \
	--build-arg BUILDKIT_INLINE_CACHE=1 \
	--tag "$img" \
	.
	- name: docker login
	run: docker login --username "$DOCKER_USER" --password-stdin ghcr.io <<< "$DOCKER_PASS"
	env:
	DOCKER_USER: ${{ github.actor }}
	DOCKER_PASS: ${{ secrets.GITHUB_TOKEN }}
	if: github.event_name != 'pull_request'
	- name: docker push
	run: \|
	set -euxo pipefail

	craft_builder=ghcr.io/getsentry/craft-builder:latest
	craft_latest=ghcr.io/getsentry/craft:latest
	craft_versioned="ghcr.io/getsentry/craft:${GITHUB_SHA}"

	docker push "$craft_builder"

	docker tag "$craft_latest" "$craft_versioned"
	docker push "$craft_versioned"
	docker push "$craft_latest"
	if: github.event_name != 'pull_request'