ci: extract GHCR image publish into manually-dispatchable workflow#349
Merged
ci: extract GHCR image publish into manually-dispatchable workflow#349
Conversation
Move the image build-and-push step out of `release_prod.yml` into a new reusable workflow `publish-image.yml` that accepts the reqstool PyPI version as an explicit input and supports both `workflow_call` (from the release pipeline) and `workflow_dispatch` (for manual re-runs). This unblocks the 0.9.0 case where the image publish failed in the release run and cannot be recovered: re-running reuses the failed run's state, and `workflow_dispatch` on the release tag checks out the old (broken) workflow file. With an input-driven manual workflow, any past published version can be re-imaged on demand. Tag computation moves from `github.ref` parsing (which was brittle — the repo uses unprefixed tags like `0.9.0`, so the `!startsWith(..., 'refs/tags/v0.')` guard for the bare-major tag never matched) to `inputs.version` with a `!startsWith(inputs.version, '0.')` guard, matching the original intent. Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
CodeQL flagged docker/metadata-action, docker/setup-buildx-action, docker/login-action, and docker/build-push-action as unpinned tags. Pin each to a commit SHA matching the same major version already in use, consistent with the pattern used for pypa/gh-action-pypi-publish in release_prod.yml (introduced in #294). Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/publish-image.ymlthat publishes the reqstool image to GHCR for an explicit PyPI version.workflow_call(used fromrelease_prod.yml) andworkflow_dispatch(manual republish of any past version).release_prod.ymlnow calls this workflow onreleaseevents, passinggithub.event.release.tag_nameas the version.github.refparsing toinputs.version. The existing!startsWith(github.ref, 'refs/tags/v0.')guard for the bare-major tag never matched (this repo uses unprefixed tags like0.9.0); replaced with!startsWith(inputs.version, '0.'), matching the original intent.Motivation
0.9.0's image publish failed during the release run (stale Fastly cache in
pip install --dry-run, fixed for future runs in #348). Neither re-run norworkflow_dispatchon the0.9.0tag can recover it:workflow_dispatchon a tag uses the workflow file at that tag (still broken).workflow_dispatchonmainafter fix(ci): poll PyPI JSON API for availability check #348 produces wrong semver tags becausegithub.refis a branch.A standalone input-driven workflow sidesteps all of these.
Test plan
Publish image to GHCRwithversion: 0.9.0and verifyghcr.io/reqstool/reqstool:0.9.0,:0.9,:0,:latest,:sha-<current>are pusheddocker run --rm ghcr.io/reqstool/reqstool:0.9.0 reqstool --versionrelease_prod.yml→ reusablepublish-image.ymlchain still runs end-to-end