From 25ff8ec39beb108086ceb6e8a228bd64bbc15628 Mon Sep 17 00:00:00 2001 From: Brandt Kurowski Date: Fri, 14 Aug 2026 15:41:40 -0400 Subject: [PATCH] Allow triggering the Docker build manually Adds workflow_dispatch so the image can be rebuilt on demand instead of waiting for the weekly schedule or pushing an empty commit. Running it on a branch tags the image after that branch, same as a push. Includes a no_cache input: cache-from: type=gha would otherwise replay the cached base image and package-install layers, which is exactly what a security rebuild needs to discard. Defaults to false, so scheduled, push, and pull_request builds are unchanged. Closes #50 Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/docker-publish.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 350802d..dd01a1d 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -14,6 +14,15 @@ on: tags: [ 'v*.*.*' ] pull_request: branches: [ "main" ] + # Rebuild on demand, e.g. to pick up a security update without waiting for the + # weekly schedule. Select the branch to build in the "Run workflow" dialog; the + # image is tagged after that branch, same as a push to it. + workflow_dispatch: + inputs: + no_cache: + description: 'Build without cache (pulls fresh base image and re-runs package installs)' + type: boolean + default: false env: # Use docker.io for Docker Hub if empty @@ -84,6 +93,10 @@ jobs: labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max + # A cached build would happily reuse the vulnerable layers a security + # rebuild is meant to replace, so let the operator opt out of the cache. + no-cache: ${{ inputs.no_cache == true }} + pull: ${{ inputs.no_cache == true }} # Sign the resulting Docker image digest. # This will only write to the public Rekor transparency log when the Docker