[BRE-5080] Build and publish cov-diff images to GHCR

.github/workflows/dependency-review.yml

@@ -10,9 +10,9 @@ jobs:
         runs-on: ubuntu-latest
         steps:
         - name: 'Checkout Repository'
-            uses: actions/checkout@v2
+          uses: actions/checkout@v2
         - name: Dependency Review
-            uses: github/dependency-review-action@v1
-            with:
-                # Possible values: "critical", "high", "moderate", "low"
-                fail-on-severity: 'high'
+          uses: actions/dependency-review-action@v1
+          with:
+            # Possible values: "critical", "high", "moderate", "low"
+            fail-on-severity: 'high'

.github/workflows/integration.yaml

@@ -21,7 +21,7 @@ jobs:
 
       - name: self test
         id: selftest
-        uses: panagiotisptr/cov-diff@main
+        uses: ./
         with:
           path: .
           coverprofile: coverage.out

.github/workflows/publish-image.yaml

@@ -0,0 +1,46 @@
+name: Build coverage image
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    env:
+      IMAGE: ghcr.io/rewardstyle/cov-diff
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build image
+        run: |
+          docker build \
+            --tag "$IMAGE:sha-$GITHUB_SHA" \
+            --tag "$IMAGE:main" \
+            --label "org.opencontainers.image.source=https://github.com/rewardStyle/cov-diff" \
+            --label "org.opencontainers.image.revision=$GITHUB_SHA" \
+            .
+
+      - name: Smoke test image
+        run: docker run --rm "$IMAGE:sha-$GITHUB_SHA" cov-diff --help
+
+      - name: Log in to GitHub Container Registry
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Publish tested image
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: |
+          docker push "$IMAGE:sha-$GITHUB_SHA"
+          docker push "$IMAGE:main"

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.21
+FROM mirror.gcr.io/library/golang:1.21
 
 WORKDIR /cov-diff
 COPY . /cov-diff

README.md

@@ -60,3 +60,17 @@ jobs:
 ## Things to watch out for
 
 When generating the diff, keep in mind that the `target` branch will have commits that your `feature` branch won't. You'd normally get these changes if you merged the target branch into your feature branch right before opening the PR. In order to ignore these changes during the diff, you need to add the 3 dots (`...`) between the two branches (see example above). You can find the relevant documentation here: https://git-scm.com/docs/git-diff#Documentation/git-diff.txt-emgitdiffemltoptionsgtltcommitgtltcommitgt--ltpathgt82308203-1
+
+## Prebuilt LTK image
+
+The image workflow builds and smoke-tests `ghcr.io/rewardstyle/cov-diff` in hosted
+CI. Pull requests validate the image without publishing. Pushes to `main` publish
+the tested image with `sha-<full-commit-sha>` and `main` tags, using the repository's
+`GITHUB_TOKEN` rather than AWS credentials.
+
+Consumers can pin the published image by digest to avoid building the action's
+Dockerfile on each run. The existing `action.yaml` still uses its Dockerfile;
+switching consumers to the prebuilt image is a separate change after publication.
+
+New GHCR packages default to private. Anonymous pulls require the package to be
+made public explicitly; this workflow does not change package visibility.