Update docker/build-push-action #3198
Conversation
WalkthroughUpdated multiple GitHub Actions workflows to use Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant GH as GitHub Actions
participant BuildPush as docker/build-push-action@v6
participant Registry as Container Registry
GH->>BuildPush: invoke build (context, file, push)
note right of BuildPush #DDEBF7: v6 receives\n`tags` input
BuildPush->>Registry: push image :${GCR_VERSION}
BuildPush->>Registry: push image :latest
Registry-->>BuildPush: ack
BuildPush-->>GH: step complete
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests
Tip 👮 Agentic pre-merge checks are now available in preview!Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.
Please see the documentation for more information. Example: reviews:
pre_merge_checks:
custom_checks:
- name: "Undocumented Breaking Changes"
mode: "warning"
instructions: |
Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).Please share your feedback with us on this Discord post. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (6)
.github/workflows/devcontainer-all.yaml (1)
55-63: Confirm v6 input/output parity & pin digest for reproducibility
docker/build-push-actionv6 removes some deprecated inputs and introduces new defaults (e.g.,load: trueauto-loads images). The currentwith:block (file,push,tags) is still supported, but please double-check the v6 release notes to ensure no silent behaviour changes affect this workflow.
For supply-chain stability, consider pinning to the major tag + digest, e.g.docker/build-push-action@v6@sha256:<digest>..github/workflows/devcontainer-ti.yaml (1)
55-63: Same v6 compatibility & digest pinning considerationsReplicate the v6 release-notes check and digest pinning suggestion here to maintain consistent, reproducible builds across all dev-container workflows.
.github/workflows/devcontainer-azurertos.yaml (1)
55-63: Validate behaviour change after upgrading to v6Ensure
push: trueand tag handling behave exactly as before; v6 tweaks cache-related defaults that could impact build time or registry content. Pin to a digest for immutability if possible..github/workflows/devcontainer-esp32.yml (1)
55-63: Upgrade sanity-check and optional digest pinConfirm no deprecated inputs (e.g.,
context,platforms) are implicitly relied upon. Consider locking the action to@v6@sha256:<digest>to avoid unexpected future changes..github/workflows/devcontainer-chibios.yaml (1)
55-63: Consistency check after bump to v6Double-check the ChibiOS image still builds & pushes as expected with the new major version and apply digest pinning for deterministic CI runs.
.github/workflows/devcontainer-freertos-nxp.yaml (1)
55-57: Verify v6 migration settings (provenance,sbom, cache) before merging
docker/build-push-action@v6introduces new defaults (provenance: true,sbom: true, different cache-from/to syntax).
If you don’t explicitly want provenance/SBOM generation or intend to keep the current cache behaviour, add the relevant inputs:- - name: Build and Push Docker Image - uses: docker/build-push-action@v6 + - name: Build and Push Docker Image + uses: docker/build-push-action@v6 + with: + provenance: false # disable SLSA attestation if not required + sbom: false # disable SBOM upload if not required + # cache-from / cache-to examples: + # cache-from: type=registry,ref=${{ env.CONTAINER_REPO }}/...:cache + # cache-to: type=registry,ref=${{ env.CONTAINER_REPO }}/...:cache,mode=max(Or keep them enabled deliberately—just make the choice explicit.)
Also consider pinning to a full semver tag or SHA for supply-chain safety, e.g.
docker/[email protected].
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
.github/workflows/devcontainer-all.yaml(1 hunks).github/workflows/devcontainer-azurertos.yaml(1 hunks).github/workflows/devcontainer-chibios.yaml(1 hunks).github/workflows/devcontainer-esp32.yml(1 hunks).github/workflows/devcontainer-freertos-nxp.yaml(1 hunks).github/workflows/devcontainer-ti.yaml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (17)
- GitHub Check: nf-interpreter (Nightly build) (Check_Build_Options)
- GitHub Check: nf-interpreter (Check_Build_Options)
- GitHub Check: build-target (ESP32_C3, Debug, ESP32)
- GitHub Check: build-target (TI_CC1352R1_LAUNCHXL, Debug, All, 915)
- GitHub Check: build-target (TI_CC1352R1_LAUNCHXL, Debug, TI, 915)
- GitHub Check: build-target (NXP_MIMXRT1060_EVK, Debug, All)
- GitHub Check: build-target (NXP_MIMXRT1060_EVK, Debug, FreeRTOS-NXP)
- GitHub Check: build-target (ESP32_H2_THREAD, Debug, ESP32)
- GitHub Check: build-target (M5Core2, Debug, ESP32)
- GitHub Check: build-target (ESP32_S2_USB, Debug, ESP32)
- GitHub Check: build-target (ST_STM32F769I_DISCOVERY, Debug, ChibiOS)
- GitHub Check: build-target (ESP32_C6_THREAD, Debug, ESP32)
- GitHub Check: build-target (ST_STM32F769I_DISCOVERY, Debug, All)
- GitHub Check: build-target (ESP32_S3, Debug, ESP32)
- GitHub Check: build-target (ESP_WROVER_KIT, Debug, ESP32)
- GitHub Check: build-target (SL_STK3701A, Debug, All)
- GitHub Check: build-target (SL_STK3701A, Debug, AzureRTOS)
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
.github/workflows/devcontainer-esp32.yml (1)
58-65: Optional: enable SBOM/provenance attestations with v6.Adds supply‑chain metadata with minimal overhead.
Apply within this block:with: file: ${{ env.CONTAINER_SRC_FILE }} push: true # Will only build if this is not here tags: | ${{ env.CONTAINER_REPO }}/${{ github.repository_owner }}/${{ env.CONTAINER_NAME }}:${{ env.GCR_VERSION }} ${{ env.CONTAINER_REPO }}/${{ github.repository_owner }}/${{ env.CONTAINER_NAME }}:latest + sbom: true + provenance: trueDocs: SBOM/provenance on build-push-action@v6; v6 also emits a job summary by default. (docs.docker.com)
.github/workflows/devcontainer-azurertos.yaml (2)
58-65: Optional: add SBOM/provenance generation.Strengthens image traceability; simple toggle with v6.
with: file: ${{ env.CONTAINER_SRC_FILE }} push: true # Will only build if this is not here tags: | ${{ env.CONTAINER_REPO }}/${{ github.repository_owner }}/${{ env.CONTAINER_NAME }}:${{ env.GCR_VERSION }} ${{ env.CONTAINER_REPO }}/${{ github.repository_owner }}/${{ env.CONTAINER_NAME }}:latest + sbom: true + provenance: trueSee guidance. (docs.docker.com)
58-65: Heads-up: v6 build record artifact.Same note as the ESP32 workflow—ensure any actions/download-artifact steps don’t unintentionally fetch “*.dockerbuild” artifacts.
Use the audit script from the previous comment; it covers all workflows. (github.com)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
.github/workflows/devcontainer-all.yaml(1 hunks).github/workflows/devcontainer-azurertos.yaml(1 hunks).github/workflows/devcontainer-chibios.yaml(1 hunks).github/workflows/devcontainer-esp32.yml(1 hunks).github/workflows/devcontainer-freertos-nxp.yaml(1 hunks).github/workflows/devcontainer-ti.yaml(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (4)
- .github/workflows/devcontainer-chibios.yaml
- .github/workflows/devcontainer-freertos-nxp.yaml
- .github/workflows/devcontainer-ti.yaml
- .github/workflows/devcontainer-all.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (17)
- GitHub Check: nf-interpreter (Nightly build) (Check_Build_Options)
- GitHub Check: nf-interpreter (Check_Build_Options)
- GitHub Check: build-target (ESP32_C6_THREAD, Debug, ESP32)
- GitHub Check: build-target (NXP_MIMXRT1060_EVK, Debug, All)
- GitHub Check: build-target (SL_STK3701A, Debug, AzureRTOS)
- GitHub Check: build-target (ESP32_C3, Debug, ESP32)
- GitHub Check: build-target (NXP_MIMXRT1060_EVK, Debug, FreeRTOS-NXP)
- GitHub Check: build-target (TI_CC1352R1_LAUNCHXL, Debug, All, 915)
- GitHub Check: build-target (ESP32_H2_THREAD, Debug, ESP32)
- GitHub Check: build-target (TI_CC1352R1_LAUNCHXL, Debug, TI, 915)
- GitHub Check: build-target (ESP_WROVER_KIT, Debug, ESP32)
- GitHub Check: build-target (ST_STM32F769I_DISCOVERY, Debug, ChibiOS)
- GitHub Check: build-target (ESP32_S3, Debug, ESP32)
- GitHub Check: build-target (ST_STM32F769I_DISCOVERY, Debug, All)
- GitHub Check: build-target (ESP32_S2_USB, Debug, ESP32)
- GitHub Check: build-target (M5Core2, Debug, ESP32)
- GitHub Check: build-target (SL_STK3701A, Debug, All)
🔇 Additional comments (3)
.github/workflows/devcontainer-esp32.yml (2)
58-58: Upgrade to docker/build-push-action@v6 looks good.Inputs used here (
file,push,tags) are compatible with v6; no breaking changes for this step.
See: docker/build-push-action docs. (github.com)
58-65: Heads-up: docker/build-push-action@v6 uploads build-record artifacts — no action required now.
- v6 present in: .github/workflows/devcontainer-esp32.yml, .github/workflows/devcontainer-all.yaml, .github/workflows/devcontainer-azurertos.yaml, .github/workflows/devcontainer-chibios.yaml, .github/workflows/devcontainer-freertos-nxp.yaml, .github/workflows/devcontainer-ti.yaml
- No occurrences of actions/download-artifact were found in .github/workflows. To ignore build-record artifacts in any download-artifact steps use:
with:
pattern: "!*.dockerbuild".github/workflows/devcontainer-azurertos.yaml (1)
58-58: Upgrade to docker/build-push-action@v6 looks good.Inputs here remain valid with v6; behavior is unchanged for build/push/tags.
Docs reference. (github.com)
Description
Update docker/build-push-action to V6
CI failures are due to CMSIS quota limit.
Motivation and Context
Keeps GH actions up-to-date
How Has This Been Tested?
CI
Screenshots
Types of changes
Checklist
Summary by CodeRabbit