ci: build and publish Docker image to GHCR - #89
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved concurrency and credential-exposure risks affect published images.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds a GitHub Actions workflow to build and publish Docker images to GHCR.
Changes:
- Configures Docker Buildx and GHCR authentication.
- Publishes branch, tag, SHA, and
latesttags. - Enables GitHub Actions layer caching.
File summaries
| File | Summary |
|---|---|
.github/workflows/docker.yml |
Adds GHCR publishing but requires concurrency controls and protection against exposing checkout credentials in the image. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| - name: Build and push image | ||
| uses: docker/build-push-action@v6 | ||
| with: | ||
| context: . |
| jobs: | ||
| docker: | ||
| runs-on: ubuntu-latest |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f3b5cfbaae
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - name: Build and push image | ||
| uses: docker/build-push-action@v6 | ||
| with: | ||
| context: . |
There was a problem hiding this comment.
Because this uses a local path context, the repository has no .dockerignore, and Dockerfile:10 runs COPY . ., the image includes .git/config. actions/checkout defaults to persist-credentials: true, so that config contains the job's authenticated Git extraheader until post-job cleanup; every pushed image can therefore contain the active GITHUB_TOKEN. Set persist-credentials: false and exclude .git from the build context before publishing.
Useful? React with 👍 / 👎.
| type=raw,value=latest,enable={{is_default_branch}} | ||
| type=ref,event=branch |
There was a problem hiding this comment.
When two pushes to main are processed concurrently, both runs publish the mutable latest and main tags, so a slower run for the older commit can finish last and move those tags backward. This repository's release workflow also pushes a release commit after ordinary main pushes, routinely creating overlapping Docker runs; add ref-scoped concurrency with cancellation or otherwise ensure only the newest main run can update these tags.
Useful? React with 👍 / 👎.
Adds a GitHub Actions workflow to build and publish the Docker image to GHCR.
The workflow publishes
ghcr.io/${{ github.repository }}:lateston the default branch, plus branch/tag/SHA tags, using Docker Buildx and GitHub Actions cache.