Skip to content

Commit a178c21

Browse files
claudeclaude
committed
fix: address PR review feedback
- Pin RUNNER_VERSION to 2.321.0 instead of latest for reproducible builds - Combine skopeo and buildah into a single RUN/apt-get layer - Remove silent || true from docker load/tag in release workflow - Mount .hadolint.yaml in release workflow validation step - Fix semver parsing with proper validation in release push step - Pass manifest build args in CI test build to match release build - Fix malformed hadolint pre-commit hook entry - Track RUNNER_VERSION in update-tools workflow - Remove duplicate Poetry/UV installs from base stage (only needed for runner user) https://claude.ai/code/session_01RofXXAMZxK4irobNYjYn3W
1 parent ea59872 commit a178c21

File tree

6 files changed

+35
-30
lines changed

6 files changed

+35
-30
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,5 +36,16 @@ jobs:
3636
steps:
3737
- uses: actions/checkout@v4
3838

39+
- name: Install yq
40+
run: |
41+
sudo curl -sSL -o /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/v4.45.4/yq_linux_amd64"
42+
sudo chmod +x /usr/local/bin/yq
43+
3944
- name: Build image
40-
run: docker build -f Containerfile -t test-build .
45+
run: |
46+
BUILD_ARGS=""
47+
for arg in $(yq e '.build.args[]' manifest.yaml); do
48+
BUILD_ARGS="${BUILD_ARGS} --build-arg ${arg}"
49+
done
50+
# shellcheck disable=SC2086
51+
docker build -f Containerfile ${BUILD_ARGS} -t test-build .

‎.github/workflows/release.yaml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ jobs:
5252
- name: Validate Containerfile
5353
run: |
5454
docker pull -q ghcr.io/hadolint/hadolint:latest
55-
docker run --rm -i hadolint/hadolint:latest < Containerfile
55+
docker run --rm -i -v "$(pwd)/.hadolint.yaml:/.hadolint.yaml:ro" hadolint/hadolint:latest hadolint --config /.hadolint.yaml - < Containerfile
5656
5757
- name: Build image
5858
env:
@@ -95,8 +95,8 @@ jobs:
9595
buildah push "${IMAGE_NAME}:${IMAGE_VERSION}" "oci-archive:build/${IMAGE_NAME}.tar"
9696
9797
# Load into Docker daemon for dive scan
98-
docker load -i "build/${IMAGE_NAME}.tar" 2>/dev/null || true
99-
docker tag "$(docker images -q | head -1)" "${IMAGE_NAME}:${IMAGE_VERSION}" 2>/dev/null || true
98+
docker load -i "build/${IMAGE_NAME}.tar"
99+
docker tag "$(docker images -q | head -1)" "${IMAGE_NAME}:${IMAGE_VERSION}"
100100
101101
- name: Dive filesystem scan
102102
env:
@@ -123,14 +123,17 @@ jobs:
123123
IMAGE_NAME: ${{ steps.manifest.outputs.image_name }}
124124
REGISTRY: ${{ steps.manifest.outputs.registry }}
125125
run: |
126-
MAJOR_MINOR="${IMAGE_VERSION%.*}"
127-
MAJOR="${IMAGE_VERSION%%.*}"
126+
IFS='.' read -r MAJOR MINOR PATCH <<< "${IMAGE_VERSION}"
127+
if [ -z "${MAJOR}" ] || [ -z "${MINOR}" ] || [ -z "${PATCH}" ]; then
128+
echo "Error: IMAGE_VERSION '${IMAGE_VERSION}' is not valid semver (expected MAJOR.MINOR.PATCH)"
129+
exit 1
130+
fi
128131
129132
# Push semantic version tag (1.2.3)
130133
skopeo copy --all "oci-archive:build/${IMAGE_NAME}.tar" "docker://${REGISTRY}:${IMAGE_VERSION}"
131134
132135
# Push major.minor tag (1.2)
133-
skopeo copy --all "oci-archive:build/${IMAGE_NAME}.tar" "docker://${REGISTRY}:${MAJOR_MINOR}"
136+
skopeo copy --all "oci-archive:build/${IMAGE_NAME}.tar" "docker://${REGISTRY}:${MAJOR}.${MINOR}"
134137
135138
# Push major tag (1)
136139
skopeo copy --all "oci-archive:build/${IMAGE_NAME}.tar" "docker://${REGISTRY}:${MAJOR}"

‎.github/workflows/update-tools.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,27 +26,31 @@ jobs:
2626
gh api "repos/${repo}/releases/latest" --jq '.tag_name' | sed 's/^v//'
2727
}
2828
29+
RUNNER_LATEST=$(get_latest_version "actions/runner")
2930
ARGO_LATEST=$(get_latest_version "argoproj/argo-workflows")
3031
KARGO_LATEST=$(get_latest_version "akuity/kargo")
3132
PACK_LATEST=$(get_latest_version "buildpacks/pack")
3233
DIVE_LATEST=$(get_latest_version "wagoodman/dive")
3334
HADOLINT_LATEST=$(get_latest_version "hadolint/hadolint")
3435
YQ_LATEST=$(get_latest_version "mikefarah/yq")
3536
37+
echo "runner=${RUNNER_LATEST}" >> "$GITHUB_OUTPUT"
3638
echo "argo=${ARGO_LATEST}" >> "$GITHUB_OUTPUT"
3739
echo "kargo=${KARGO_LATEST}" >> "$GITHUB_OUTPUT"
3840
echo "pack=${PACK_LATEST}" >> "$GITHUB_OUTPUT"
3941
echo "dive=${DIVE_LATEST}" >> "$GITHUB_OUTPUT"
4042
echo "hadolint=${HADOLINT_LATEST}" >> "$GITHUB_OUTPUT"
4143
echo "yq=${YQ_LATEST}" >> "$GITHUB_OUTPUT"
4244
45+
RUNNER_CURRENT=$(grep -oP 'RUNNER_VERSION=\K[0-9.]+' Containerfile)
4346
ARGO_CURRENT=$(grep -oP 'ARGO_VERSION=\K[0-9.]+' Containerfile)
4447
KARGO_CURRENT=$(grep -oP 'KARGO_VERSION=\K[0-9.]+' Containerfile)
4548
PACK_CURRENT=$(grep -oP 'PACK_VERSION=\K[0-9.]+' Containerfile)
4649
DIVE_CURRENT=$(grep -oP 'DIVE_VERSION=\K[0-9.]+' Containerfile)
4750
HADOLINT_CURRENT=$(grep -oP 'HADOLINT_VERSION=\K[0-9.]+' Containerfile)
4851
YQ_CURRENT=$(grep -oP 'YQ_VERSION=\K[0-9.]+' Containerfile)
4952
53+
echo "runner_current=${RUNNER_CURRENT}" >> "$GITHUB_OUTPUT"
5054
echo "argo_current=${ARGO_CURRENT}" >> "$GITHUB_OUTPUT"
5155
echo "kargo_current=${KARGO_CURRENT}" >> "$GITHUB_OUTPUT"
5256
echo "pack_current=${PACK_CURRENT}" >> "$GITHUB_OUTPUT"
@@ -55,6 +59,9 @@ jobs:
5559
echo "yq_current=${YQ_CURRENT}" >> "$GITHUB_OUTPUT"
5660
5761
UPDATES=""
62+
if [ "${RUNNER_CURRENT}" != "${RUNNER_LATEST}" ]; then
63+
UPDATES="${UPDATES}- GitHub Actions Runner: ${RUNNER_CURRENT} -> ${RUNNER_LATEST}\n"
64+
fi
5865
if [ "${ARGO_CURRENT}" != "${ARGO_LATEST}" ]; then
5966
UPDATES="${UPDATES}- Argo Workflows CLI: ${ARGO_CURRENT} -> ${ARGO_LATEST}\n"
6067
fi
@@ -91,12 +98,14 @@ jobs:
9198
- name: Update versions in Containerfile and manifest
9299
if: steps.versions.outputs.has_updates == 'true'
93100
env:
101+
RUNNER_LATEST: ${{ steps.versions.outputs.runner }}
94102
ARGO_LATEST: ${{ steps.versions.outputs.argo }}
95103
KARGO_LATEST: ${{ steps.versions.outputs.kargo }}
96104
PACK_LATEST: ${{ steps.versions.outputs.pack }}
97105
DIVE_LATEST: ${{ steps.versions.outputs.dive }}
98106
HADOLINT_LATEST: ${{ steps.versions.outputs.hadolint }}
99107
YQ_LATEST: ${{ steps.versions.outputs.yq }}
108+
RUNNER_CURRENT: ${{ steps.versions.outputs.runner_current }}
100109
ARGO_CURRENT: ${{ steps.versions.outputs.argo_current }}
101110
KARGO_CURRENT: ${{ steps.versions.outputs.kargo_current }}
102111
PACK_CURRENT: ${{ steps.versions.outputs.pack_current }}
@@ -111,6 +120,7 @@ jobs:
111120
fi
112121
}
113122
123+
update_version "RUNNER_VERSION" "${RUNNER_CURRENT}" "${RUNNER_LATEST}"
114124
update_version "ARGO_VERSION" "${ARGO_CURRENT}" "${ARGO_LATEST}"
115125
update_version "KARGO_VERSION" "${KARGO_CURRENT}" "${KARGO_LATEST}"
116126
update_version "PACK_VERSION" "${PACK_CURRENT}" "${PACK_LATEST}"

‎.pre-commit-config.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ repos:
1313
rev: v2.12.0
1414
hooks:
1515
- id: hadolint-docker
16-
entry: hadolint/hadolint hadolint
1716
args: ["--config", ".hadolint.yaml"]
1817

1918
- repo: https://github.com/shellcheck-py/shellcheck-py

‎Containerfile‎

Lines changed: 3 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
ARG RUNNER_VERSION=latest
1+
ARG RUNNER_VERSION=2.321.0
22

33
FROM ghcr.io/actions/runner:${RUNNER_VERSION} as base
44

@@ -25,17 +25,10 @@ RUN apt-get update \
2525
&& apt-get clean \
2626
&& rm -rf /var/lib/apt/lists/*
2727

28-
# Install skopeo
28+
# Install skopeo and buildah
2929
# hadolint ignore=DL3008
3030
RUN apt-get update \
31-
&& apt-get install --no-install-recommends -y skopeo \
32-
&& apt-get clean \
33-
&& rm -rf /var/lib/apt/lists/*
34-
35-
# Install buildah
36-
# hadolint ignore=DL3008
37-
RUN apt-get update \
38-
&& apt-get install --no-install-recommends -y buildah \
31+
&& apt-get install --no-install-recommends -y skopeo buildah \
3932
&& apt-get clean \
4033
&& rm -rf /var/lib/apt/lists/*
4134

@@ -102,17 +95,6 @@ RUN curl -sSL -o /tmp/pack.tgz \
10295
# hadolint ignore=DL3013
10396
RUN pip install --no-cache-dir pre-commit
10497

105-
# Install Poetry latest version and add it to PATH
106-
# hadolint ignore=DL4006
107-
RUN curl -sSL https://install.python-poetry.org | python3 -
108-
109-
# Install UV
110-
# hadolint ignore=DL4006
111-
RUN curl -LsSf https://astral.sh/uv/install.sh | sh
112-
113-
# Add Poetry and UV to PATH
114-
RUN echo "export PATH=\"${APP_HOME}/.local/bin:\$PATH\"" >> ~/.bashrc
115-
11698
FROM base as runtime
11799

118100
LABEL org.opencontainers.image.source=https://github.com/deerhide/python-github-runner

‎manifest.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ registry: ghcr.io/deerhide/python-github-runner
55
build:
66
format: oci
77
args:
8-
- RUNNER_VERSION=latest
8+
- RUNNER_VERSION=2.321.0
99
- ARGO_VERSION=3.6.4
1010
- KARGO_VERSION=1.9.2
1111
- PACK_VERSION=0.36.4

0 commit comments

Comments
 (0)