From 21bdbec474d4913b2801991fcf3c0e4fe6994fcc Mon Sep 17 00:00:00 2001 From: Alex Bice Date: Fri, 9 Oct 2026 14:17:38 -0700 Subject: [PATCH 1/5] fix: use GCR mirror for cov-diff base image [BRE-5079] --- .github/workflows/integration.yaml | 2 +- Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml index 6baeaf9..dd6cc57 100644 --- a/.github/workflows/integration.yaml +++ b/.github/workflows/integration.yaml @@ -21,7 +21,7 @@ jobs: - name: self test id: selftest - uses: panagiotisptr/cov-diff@main + uses: ./ with: path: . coverprofile: coverage.out diff --git a/Dockerfile b/Dockerfile index 81087e7..2d09e08 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.21 +FROM mirror.gcr.io/library/golang:1.21 WORKDIR /cov-diff COPY . /cov-diff From afa04e6e55e0dffc3bb9ca7313fdaee94cfe0203 Mon Sep 17 00:00:00 2001 From: Alex Bice Date: Fri, 9 Oct 2026 14:19:51 -0700 Subject: [PATCH 2/5] ci: repair dependency review YAML indentation [BRE-5079] --- .github/workflows/dependency-review.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index d6aa436..09cb7e5 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -10,9 +10,9 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Checkout Repository' - uses: actions/checkout@v2 + uses: actions/checkout@v2 - name: Dependency Review - uses: github/dependency-review-action@v1 - with: - # Possible values: "critical", "high", "moderate", "low" - fail-on-severity: 'high' + uses: github/dependency-review-action@v1 + with: + # Possible values: "critical", "high", "moderate", "low" + fail-on-severity: 'high' From b207f6c98a027a6dc7811da2fa047f194041bcf3 Mon Sep 17 00:00:00 2001 From: Alex Bice Date: Fri, 9 Oct 2026 14:20:52 -0700 Subject: [PATCH 3/5] ci: correct dependency review action repository [BRE-5079] --- .github/workflows/dependency-review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 09cb7e5..091f9db 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -12,7 +12,7 @@ jobs: - name: 'Checkout Repository' uses: actions/checkout@v2 - name: Dependency Review - uses: github/dependency-review-action@v1 + uses: actions/dependency-review-action@v1 with: # Possible values: "critical", "high", "moderate", "low" fail-on-severity: 'high' From 2a6b83ebad472242874d655abc00d95ba39c268e Mon Sep 17 00:00:00 2001 From: Alex Bice Date: Fri, 9 Oct 2026 14:27:00 -0700 Subject: [PATCH 4/5] ci: build and publish cov-diff images to GHCR [BRE-5080] --- .github/workflows/publish-image.yaml | 54 ++++++++++++++++++++++++++++ README.md | 14 ++++++++ 2 files changed, 68 insertions(+) create mode 100644 .github/workflows/publish-image.yaml diff --git a/.github/workflows/publish-image.yaml b/.github/workflows/publish-image.yaml new file mode 100644 index 0000000..cdcb3d3 --- /dev/null +++ b/.github/workflows/publish-image.yaml @@ -0,0 +1,54 @@ +name: Build coverage image + +on: + pull_request: + push: + branches: [main] + +permissions: + contents: read + +jobs: + image: + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + env: + IMAGE: ghcr.io/rewardstyle/cov-diff + steps: + - uses: actions/checkout@v4 + + - uses: docker/setup-buildx-action@v3 + + - name: Build image + uses: docker/build-push-action@v6 + with: + context: . + load: true + push: false + tags: | + ${{ env.IMAGE }}:sha-${{ github.sha }} + ${{ env.IMAGE }}:main + labels: | + org.opencontainers.image.source=https://github.com/rewardStyle/cov-diff + org.opencontainers.image.revision=${{ github.sha }} + cache-from: type=gha + cache-to: type=gha,mode=max + + - name: Smoke test image + run: docker run --rm "$IMAGE:sha-$GITHUB_SHA" cov-diff --help + + - name: Log in to GitHub Container Registry + if: github.event_name == 'push' && github.ref == 'refs/heads/main' + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Publish tested image + if: github.event_name == 'push' && github.ref == 'refs/heads/main' + run: | + docker push "$IMAGE:sha-$GITHUB_SHA" + docker push "$IMAGE:main" diff --git a/README.md b/README.md index c253e4d..e1e23d7 100644 --- a/README.md +++ b/README.md @@ -60,3 +60,17 @@ jobs: ## Things to watch out for When generating the diff, keep in mind that the `target` branch will have commits that your `feature` branch won't. You'd normally get these changes if you merged the target branch into your feature branch right before opening the PR. In order to ignore these changes during the diff, you need to add the 3 dots (`...`) between the two branches (see example above). You can find the relevant documentation here: https://git-scm.com/docs/git-diff#Documentation/git-diff.txt-emgitdiffemltoptionsgtltcommitgtltcommitgt--ltpathgt82308203-1 + +## Prebuilt LTK image + +The image workflow builds and smoke-tests `ghcr.io/rewardstyle/cov-diff` in hosted +CI. Pull requests validate the image without publishing. Pushes to `main` publish +the tested image with `sha-` and `main` tags, using the repository's +`GITHUB_TOKEN` rather than AWS credentials. + +Consumers can pin the published image by digest to avoid building the action's +Dockerfile on each run. The existing `action.yaml` still uses its Dockerfile; +switching consumers to the prebuilt image is a separate change after publication. + +New GHCR packages default to private. Anonymous pulls require the package to be +made public explicitly; this workflow does not change package visibility. From dd24bd4b4b89888c49744f28f45b7b1a34d32c22 Mon Sep 17 00:00:00 2001 From: Alex Bice Date: Fri, 9 Oct 2026 14:28:28 -0700 Subject: [PATCH 5/5] ci: use runner Docker builder without extra registry pulls [BRE-5080] --- .github/workflows/publish-image.yaml | 22 +++++++--------------- 1 file changed, 7 insertions(+), 15 deletions(-) diff --git a/.github/workflows/publish-image.yaml b/.github/workflows/publish-image.yaml index cdcb3d3..84f9f96 100644 --- a/.github/workflows/publish-image.yaml +++ b/.github/workflows/publish-image.yaml @@ -19,22 +19,14 @@ jobs: steps: - uses: actions/checkout@v4 - - uses: docker/setup-buildx-action@v3 - - name: Build image - uses: docker/build-push-action@v6 - with: - context: . - load: true - push: false - tags: | - ${{ env.IMAGE }}:sha-${{ github.sha }} - ${{ env.IMAGE }}:main - labels: | - org.opencontainers.image.source=https://github.com/rewardStyle/cov-diff - org.opencontainers.image.revision=${{ github.sha }} - cache-from: type=gha - cache-to: type=gha,mode=max + run: | + docker build \ + --tag "$IMAGE:sha-$GITHUB_SHA" \ + --tag "$IMAGE:main" \ + --label "org.opencontainers.image.source=https://github.com/rewardStyle/cov-diff" \ + --label "org.opencontainers.image.revision=$GITHUB_SHA" \ + . - name: Smoke test image run: docker run --rm "$IMAGE:sha-$GITHUB_SHA" cov-diff --help