From c36ae33c678849e453c4f0e20b175184c0803f1a Mon Sep 17 00:00:00 2001 From: Jean-Philippe Evrard Date: Mon, 8 Jun 2026 18:28:28 +0200 Subject: [PATCH] fix: stop building main branch containers Without this, we will continue building and storing artifacts that are used by less than 10% of our community. This means maintaining different workflows and complicates goreleaser for really no reason. If someone has a strong opposition to this practice, please tell me, I will revert this commit. Signed-off-by: Jean-Philippe Evrard --- ...on-pr.yaml => on-branch-push-and-prs.yaml} | 17 ++--- .github/workflows/on-main-push.yaml | 74 ------------------- .github/workflows/on-tag.yaml | 9 +-- .github/workflows/periodics-weekly.yaml | 6 +- 4 files changed, 9 insertions(+), 97 deletions(-) rename .github/workflows/{on-pr.yaml => on-branch-push-and-prs.yaml} (93%) delete mode 100644 .github/workflows/on-main-push.yaml diff --git a/.github/workflows/on-pr.yaml b/.github/workflows/on-branch-push-and-prs.yaml similarity index 93% rename from .github/workflows/on-pr.yaml rename to .github/workflows/on-branch-push-and-prs.yaml index 92ff99d..03b7b72 100644 --- a/.github/workflows/on-pr.yaml +++ b/.github/workflows/on-branch-push-and-prs.yaml @@ -1,11 +1,12 @@ -name: PR +name: Branch push and PR on: pull_request: push: - branches-ignore: - - main - tags-ignore: - - "*" + branches: + - "**" + +permissions: + contents: read jobs: pr-short-tests: @@ -54,12 +55,8 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 - - name: Find current tag version - run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT - id: tags - - name: Build image - run: VERSION="${{ steps.tags.outputs.sha_short }}" IMAGE_NAME="${{ github.repository }}" make dev-image + run: make dev-image - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 diff --git a/.github/workflows/on-main-push.yaml b/.github/workflows/on-main-push.yaml deleted file mode 100644 index fc8a810..0000000 --- a/.github/workflows/on-main-push.yaml +++ /dev/null @@ -1,74 +0,0 @@ -name: Push image of latest main -on: - push: - branches: - - main - -env: - REGISTRY: ghcr.io - IMAGE_NAME: ${{ github.repository }} - -permissions: - contents: read - -jobs: - tag-scan-and-push-final-image: - name: Build, scan, and publish main image - runs-on: ubuntu-latest - permissions: - id-token: write - contents: read - packages: write - steps: - - name: Harden Runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 - with: - egress-policy: audit - - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - with: - fetch-depth: 0 - - - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0 - with: - version: 2026.6.1 - - - name: Set up QEMU - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 - - - name: Find current commit - id: version - run: echo "sha_short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT" - - - name: Build local image for scan - run: VERSION="${{ steps.version.outputs.sha_short }}" IMAGE_NAME="${{ github.repository }}" make dev-image - env: - IMAGE_NAME: ${{ github.repository }} - - - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 - with: - image-ref: kured:dev - format: 'table' - exit-code: '1' - ignore-unfixed: true - vuln-type: 'os,library' - severity: 'CRITICAL,HIGH' - - - name: Login to ghcr.io - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 - with: - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Build, publish, SBOM, and sign image - run: make release - env: - DISABLE_GITHUB_RELEASE: "true" - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GORELEASER_CURRENT_TAG: ${{ steps.version.outputs.sha_short }} - IMAGE_NAME: ${{ github.repository }} diff --git a/.github/workflows/on-tag.yaml b/.github/workflows/on-tag.yaml index 99ad8a7..b2bf069 100644 --- a/.github/workflows/on-tag.yaml +++ b/.github/workflows/on-tag.yaml @@ -33,10 +33,6 @@ jobs: with: version: 2026.6.1 - - name: Find current commit - id: version - run: echo "sha_short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT" - - name: Set up QEMU uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 @@ -44,9 +40,7 @@ jobs: uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 - name: Build local image for scan - run: VERSION="${{ steps.version.outputs.sha_short }}" IMAGE_NAME="${{ github.repository }}" make dev-image - env: - IMAGE_NAME: ${{ github.repository }} + run: make dev-image - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 @@ -69,4 +63,3 @@ jobs: run: make release env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - IMAGE_NAME: ${{ github.repository }} diff --git a/.github/workflows/periodics-weekly.yaml b/.github/workflows/periodics-weekly.yaml index 77c300a..3532dbc 100644 --- a/.github/workflows/periodics-weekly.yaml +++ b/.github/workflows/periodics-weekly.yaml @@ -90,12 +90,8 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 - - name: Find current tag version - run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT - id: tags - - name: Build artifacts - run: VERSION="${{ steps.tags.outputs.sha_short }}" IMAGE_NAME="${{ github.repository }}" make dev-image + run: make dev-image - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: