ci: simplify Patch Release Me 0.6.7 invocation - #226
Merged
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Copilot review overview
Review tier: Lite
Findings: 2
New issues introduced by this change (2)
| Severity | Finding |
|---|---|
 |
.github/workflows/update-release.yml — uses: docker://… container steps do not word-split with: args; the entire args: string is… |
|
.github/workflows/update-codeql-version.yml — Same issue as update-release.yml: for uses: docker://… steps, with: args is passed to the… |
What changed in this PR
This PR updates the two release-bump workflows to invoke Patch Release Me via uses: docker://… with a pinned 0.6.7 image+digest, aiming to remove the prior manual docker run plumbing while keeping bumps reproducible and immutable.
Changes:
- Replaced the prior
run: docker run …workaround withuses: docker://ghcr.io/42bytelabs/patch-release-me:0.6.7@sha256:…in both workflows. - Pinned the Patch Release Me container reference to a specific
0.6.7image digest. - Added a TODO note about returning to the upstream action after upstream digest-pins its runtime image.
| File | Description |
|---|---|
| .github/workflows/update-release.yml | Swaps the release bump step to a docker:// container action invocation of Patch Release Me 0.6.7. |
| .github/workflows/update-codeql-version.yml | Swaps the optional version bump step to the same docker:// Patch Release Me 0.6.7 invocation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
docker runworkarounds with GitHub's native Docker action syntax.Why
Patch Release Me 0.6.7 fixes the mode argument handling and has a published container image. Calling the image through
docker://...:0.6.7@sha256:...preserves immutable execution while allowing GitHub Actions to manage the workspace and arguments.The repository action is not used yet because its Dockerfile still references a mutable image tag.
Validation
git diff --check.docker buildx imagetools inspect.