Revert "Bump docker/build-push-action from 6 to 7"#175
Conversation
WalkthroughTwo GitHub Actions workflow files downgrade the docker/build-push-action tool from version 7 to version 6. The changes modify the "Build Docker image" step in the Anchore Grype workflow and the "Build and push Docker image" step in the publish Docker workflow, affecting the action version reference without altering other configuration parameters. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~5 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs). Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/anchore.yml (1)
42-42: Avoid broadening the rollback to the Anchore job without evidence.The reported failure was in
publish-docker.ymlduringdocker/metadata-action@v6, and this workflow does not use that action. Rolling this job back introduces unnecessary version skew on an unrelated path. Keepdocker/build-push-action@v7here.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/anchore.yml at line 42, The workflow was changed to use "docker/build-push-action@v6" which broadens a rollback unnecessarily; revert that line so it uses "docker/build-push-action@v7" (restore the original version string), leaving the Anchore job unchanged and avoiding version skew with the unrelated `publish-docker.yml` path.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/publish-docker.yml:
- Line 67: The revert changing uses: docker/build-push-action@v6 does not
address the actual failure which occurs earlier in the metadata step using
docker/metadata-action@v6 and its type=match rules; update the metadata step
instead by either pinning or upgrading docker/metadata-action to a version that
fixes the type=match bug or adjust the step's type=match rules to avoid the
failing pattern (modify the metadata step configuration that references
type=match), and keep docker/build-push-action@v6 unchanged unless a separate
compatibility issue is proven; locate the metadata step
(docker/metadata-action@v6 and the type=match configuration) and apply the
corrected action version or fixed matching rules.
---
Nitpick comments:
In @.github/workflows/anchore.yml:
- Line 42: The workflow was changed to use "docker/build-push-action@v6" which
broadens a rollback unnecessarily; revert that line so it uses
"docker/build-push-action@v7" (restore the original version string), leaving the
Anchore job unchanged and avoiding version skew with the unrelated
`publish-docker.yml` path.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 41aaaf04-f108-469c-acdc-f9ab966d9575
📒 Files selected for processing (2)
.github/workflows/anchore.yml.github/workflows/publish-docker.yml
| - | ||
| name: Build and push Docker image | ||
| uses: docker/build-push-action@v7 | ||
| uses: docker/build-push-action@v6 |
There was a problem hiding this comment.
❓ Verification inconclusive
Script executed:
#!/bin/bash
set -euo pipefail
echo "== publish workflow: relevant steps =="
sed -n '52,77p' .github/workflows/publish-docker.yml
echo
echo "== ordered references =="
rg -n 'docker/metadata-action@|type=match|docker/build-push-action@' .github/workflows/publish-docker.ymlRepository: svengo/docker-tor
Repository: svengo/docker-tor
Exit code: 0
stdout:
== publish workflow: relevant steps ==
name: Build Docker meta data
id: meta
uses: docker/metadata-action@v6
with:
images: |
${{ vars.DOCKERHUB_USERNAME }}/${{ vars.IMAGE_NAME }}
ghcr.io/${{ github.repository_owner }}/${{ vars.IMAGE_NAME }}
flavor: |
latest=${{ github.event_name == 'release' && github.event.release.prerelease == false }}
tags: |
type=match,pattern=^v?((?:\d+\.){3}\d+),group=1 # 0.4.8.13
type=match,pattern=^v?(.*),group=1 # 0.4.8.13-docker.1
type=sha # sha-4e91d87
-
name: Build and push Docker image
uses: docker/build-push-action@v6
id: push
with:
context: .
file: ./Dockerfile
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
platforms: linux/amd64
== ordered references ==
54: uses: docker/metadata-action@v6
62: type=match,pattern=^v?((?:\d+\.){3}\d+),group=1 # 0.4.8.13
63: type=match,pattern=^v?(.*),group=1 # 0.4.8.13-docker.1
67: uses: docker/build-push-action@v6
This revert does not fix the failing publish workflow.
The failure reported in the PR description occurs in docker/metadata-action@v6 at the metadata step (line 54), which runs before this build step. The metadata step uses type=match rules that are still unchanged. Downgrading docker/build-push-action leaves the root cause in place and will not resolve the release-path failure.
Suggested change
- uses: docker/build-push-action@v6
+ uses: docker/build-push-action@v7📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: docker/build-push-action@v6 | |
| uses: docker/build-push-action@v7 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/publish-docker.yml at line 67, The revert changing uses:
docker/build-push-action@v6 does not address the actual failure which occurs
earlier in the metadata step using docker/metadata-action@v6 and its type=match
rules; update the metadata step instead by either pinning or upgrading
docker/metadata-action to a version that fixes the type=match bug or adjust the
step's type=match rules to avoid the failing pattern (modify the metadata step
configuration that references type=match), and keep docker/build-push-action@v6
unchanged unless a separate compatibility issue is proven; locate the metadata
step (docker/metadata-action@v6 and the type=match configuration) and apply the
corrected action version or fixed matching rules.
1 participant
Reverts #174
Error running action:
Summary by CodeRabbit