buildenv-diff.yml

name: Buildenv Package Diff
on:
  # When a PR bumps the kernel-buildenv digest pin (normally dependabot), show
  # what actually changed between the two images: each image carries its own
  # package manifest at /usr/share/buildenv/packages.tsv, so the diff is just
  # two pulls and a compare, posted to the check summary for the reviewer.
  pull_request:
    paths:
      - "Dockerfile"
permissions:
  contents: read
  packages: read
jobs:
  diff:
    name: package diff
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit
      - name: checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
      - name: docker login ghcr.io
        uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0
        with:
          action: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
          with: |
            registry: ghcr.io
            username: "${{github.actor}}"
            password: "${{secrets.GITHUB_TOKEN}}"
      - name: diff package manifests
        run: |
          extract_ref() {
            grep -oE 'ghcr\.io/edera-dev/kernel-buildenv[^[:space:]]*@sha256:[0-9a-f]+' "$1" | head -1 || true
          }
          git fetch --depth 1 origin "${{ github.base_ref }}"
          git show FETCH_HEAD:Dockerfile > Dockerfile.base 2>/dev/null || : > Dockerfile.base
          OLD_REF="$(extract_ref Dockerfile.base)"
          NEW_REF="$(extract_ref Dockerfile)"
          if [ -z "${NEW_REF}" ] || [ "${OLD_REF}" = "${NEW_REF}" ]; then
            echo "kernel-buildenv pin unchanged; nothing to diff"
            exit 0
          fi
          MANIFEST=/usr/share/buildenv/packages.tsv
          docker run --rm "${NEW_REF}" cat "${MANIFEST}" > packages-new.tsv
          {
            echo "## kernel-buildenv package changes"
            echo ""
          } >> "${GITHUB_STEP_SUMMARY}"
          if [ -z "${OLD_REF}" ]; then
            {
              echo "New pin \`${NEW_REF}\` (no previous pin to diff against);"
              echo "$(wc -l < packages-new.tsv) packages in the image."
            } >> "${GITHUB_STEP_SUMMARY}"
            exit 0
          fi
          docker run --rm "${OLD_REF}" cat "${MANIFEST}" > packages-old.tsv
          {
            echo "\`${OLD_REF}\`"
            echo "→ \`${NEW_REF}\`"
            echo ""
            if diff -u packages-old.tsv packages-new.tsv > packages.diff; then
              echo "No package version changes (image metadata/base layer only)."
            else
              echo '```diff'
              # Skip the +++/--- header noise; keep only the package changes.
              grep -E '^[+-][^+-]' packages.diff
              echo '```'
            fi
          } >> "${GITHUB_STEP_SUMMARY}"