Allow triggering the Docker build manually - #58
Merged
Conversation
Adds workflow_dispatch so the image can be rebuilt on demand instead of waiting for the weekly schedule or pushing an empty commit. Running it on a branch tags the image after that branch, same as a push. Includes a no_cache input: cache-from: type=gha would otherwise replay the cached base image and package-install layers, which is exactly what a security rebuild needs to discard. Defaults to false, so scheduled, push, and pull_request builds are unchanged. Closes #50 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
shaundrong
approved these changes
Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #50
Adds
workflow_dispatchto the Docker workflow so the image can be rebuilt on demand — for a security update, or just to republish without pushing an empty commit.Behavior
type=ref,event=branchin the metadata step coversworkflow_dispatch, so a manual run onmainpublishesghcr.io/uceap/devcontainer-drupal:mainexactly like a push does — that's the tag downstream projects consume, so this covers @shaundrong's case of wanting the real image instead of a branch image.no_cacheinput.cache-from: type=ghawould otherwise replay the cached base image andapt-getlayers, which is precisely what a security rebuild is meant to discard. Checking the box setsno-cacheandpullon the build step so the base image is re-pulled and package installs re-run.Defaults to
false, andinputs.no_cacheis empty outsideworkflow_dispatch, so== truerenders as literalfalse— scheduled, push, and PR builds are unchanged.Testing
actionlintis clean on the changed lines.main; a manual run with Build without cache checked is the real end-to-end check.Left alone
actionlintflags two pre-existing issues this PR doesn't touch —actions/checkout@v3is on a runner GitHub no longer supports, and the cosign step has an unquoted${DIGEST}(SC2086). Happy to fix either here or separately.🤖 Generated with Claude Code