From 2b6ca5f6f348d988edf88510b2e425ea6baac9a5 Mon Sep 17 00:00:00 2001 From: Jeremy Bernard Date: Thu, 24 Sep 2026 15:32:20 +0200 Subject: [PATCH 1/2] feat(docker-build): add inputs to enable building OCI image from existing artifact --- .github/workflows/docker-build.yml | 27 +++++++++++++++++++++------ docker-build/README.md | 3 +++ docker-build/workflow-sha256 | 2 +- 3 files changed, 25 insertions(+), 7 deletions(-) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index 0858926..dcd05e3 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -59,6 +59,14 @@ on: description: "GitHub Actions runner label" default: "ubuntu-latest" type: string + artifact-name: + description: "Name of an artifact to download into the build context before building, e.g. a jar produced by an earlier job (leave empty to skip)" + default: "" + type: string + artifact-path: + description: "Destination path for the downloaded artifact, relative to the workspace (ignored if `artifact-name` is empty)" + default: "" + type: string secrets: dockerhub-username: required: true @@ -107,10 +115,17 @@ jobs: echo "✅ Security report mode validation passed: $REPORT_MODE" - name: Checkout Repository - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Download build artifact + if: ${{ inputs.artifact-name != '' }} + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: ${{ inputs.artifact-name }} + path: ${{ inputs.artifact-path }} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Login to Docker Hub uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 @@ -127,7 +142,7 @@ jobs: password: ${{ secrets.password }} - name: Build Docker image - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: build-args: ${{ inputs.build-args }} context: ${{ inputs.context }} @@ -188,14 +203,14 @@ jobs: - name: Upload Trivy scan results to GitHub Security tab if: github.event_name == 'pull_request' && inputs.security-scan && inputs.security-report == 'sarif' - uses: github/codeql-action/upload-sarif@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9 + uses: github/codeql-action/upload-sarif@88585263c0627ee42c0e1c5143a112c8d6f4aa18 # v4.38.2 with: sarif_file: "trivy-results.sarif" - name: Run Hadolint Dockerfile linter id: hadolint if: ${{ inputs.hadolint }} - uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0 + uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0 with: dockerfile: ${{ inputs.dockerfile }} output-file: hadolint.txt @@ -268,7 +283,7 @@ jobs: # Requires the permissions id-token: write + attestations: write. - name: Generate & sign SLSA provenance (keyless) if: ${{ inputs.attest && inputs.push }} - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-name: ${{ inputs.image-name }} subject-digest: ${{ steps.checksum.outputs.digest }} diff --git a/docker-build/README.md b/docker-build/README.md index 108ca52..3adecb7 100644 --- a/docker-build/README.md +++ b/docker-build/README.md @@ -17,6 +17,7 @@ Perfect for teams looking to streamline their containerization workflow with min - 🛡️ Handles authentication securely using GitHub Secrets - 🚀 Optimizes build performance with layer caching - 📦 Supports AMD64 and ARM64 platforms (one per workflow run) +- 📥 Optionally pulls a build artifact from an earlier job into the build context, so a compiled binary or jar can be built once and copied into the image > [!IMPORTANT] > Due to a limitation on Trivy analysis, the workflow targets a single platform. @@ -26,6 +27,8 @@ Perfect for teams looking to streamline their containerization workflow with min | Name | Description | Required | Default | | ----------------- | ---------------------------------------------------------------------------------- | -------- | ----------------- | +| `artifact-name` | Name of an artifact to download into the build context before building, e.g. a jar produced by an earlier job (leave empty to skip) | No | `""` | +| `artifact-path` | Destination path for the downloaded artifact, relative to the workspace (ignored if `artifact-name` is empty) | No | `""` | | `attest` | Generate & sign a keyless SLSA build provenance attestation for the pushed image (requires `push: true` and caller permissions, see notes) | No | `false` | | `build-args` | Docker build arguments (multiline format: `KEY1=value1\nKEY2=value2`) | No | `""` | | `context` | Path to Docker Build Context | No | `"."` | diff --git a/docker-build/workflow-sha256 b/docker-build/workflow-sha256 index e1137cc..8821704 100644 --- a/docker-build/workflow-sha256 +++ b/docker-build/workflow-sha256 @@ -1 +1 @@ -02e205d604954431c03868fe49a190239b824e83173234bdb862a958bb63f4e3 +0088fd9667683a4fb320c2b5f3d9e27768659aca384f4c7bb06b829274111763 From 480ab9a5ac4fcd5cacd3d67a1f99949ff7f1f21e Mon Sep 17 00:00:00 2001 From: Jeremy Bernard Date: Thu, 24 Sep 2026 16:24:47 +0200 Subject: [PATCH 2/2] fix(docker-build): pin commit instead of annotated tag for upload-sarif action --- .github/workflows/docker-build.yml | 2 +- docker-build/workflow-sha256 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index dcd05e3..79c42ca 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -203,7 +203,7 @@ jobs: - name: Upload Trivy scan results to GitHub Security tab if: github.event_name == 'pull_request' && inputs.security-scan && inputs.security-report == 'sarif' - uses: github/codeql-action/upload-sarif@88585263c0627ee42c0e1c5143a112c8d6f4aa18 # v4.38.2 + uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: sarif_file: "trivy-results.sarif" diff --git a/docker-build/workflow-sha256 b/docker-build/workflow-sha256 index 8821704..e87f754 100644 --- a/docker-build/workflow-sha256 +++ b/docker-build/workflow-sha256 @@ -1 +1 @@ -0088fd9667683a4fb320c2b5f3d9e27768659aca384f4c7bb06b829274111763 +b90cf70ccbf64901db2b79cf2d320010efb34e714ff2e270d03ff2d181fa3845