akanealw/Charon
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

ci: skip heavy docker build/publish for renovate bot and chore(deps)/chore commits

Browse Source
This commit is contained in:
Wikid82
2025-11-18 23:56:23 -05:00
parent 7253dd4f5b
commit 1cf07a892a
2 changed files with 82 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
.github/workflows/docker-publish.yml vendored
View File

@@ -34,6 +34,29 @@ jobs:
raw="${{ github.repository_owner }}/${{ github.event.repository.name }}"
echo "IMAGE_NAME=$(echo "$raw" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
- name: Determine skip condition
id: skip
run: |
should_skip=false
actor='${{ github.actor }}'
event='${{ github.event_name }}'
head_msg='${{ github.event.head_commit.message }}'
pr_title=""
if [ "$event" = "pull_request" ]; then
pr_title=$(jq -r '.pull_request.title' "$GITHUB_EVENT_PATH" 2>/dev/null || echo '')
fi
if [ "$actor" = "renovate[bot]" ]; then should_skip=true; fi
if echo "$head_msg" | grep -Ei '^chore\(deps' >/dev/null 2>&1; then should_skip=true; fi
if echo "$head_msg" | grep -Ei '^chore:' >/dev/null 2>&1; then should_skip=true; fi
if echo "$pr_title" | grep -Ei '^chore\(deps' >/dev/null 2>&1; then should_skip=true; fi
if echo "$pr_title" | grep -Ei '^chore:' >/dev/null 2>&1; then should_skip=true; fi
echo "skip_build=$should_skip" >> $GITHUB_OUTPUT
if [ "$should_skip" = true ]; then
echo "Skipping heavy docker publish for actor=$actor event=$event (message/title matched)"
else
echo "Proceeding with docker publish"
fi
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
@@ -53,6 +76,7 @@ jobs:
password: ${{ secrets.GITHUB_TOKEN }}
- name: Extract metadata (tags, labels)
if: steps.skip.outputs.skip_build != 'true'
id: meta
uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5
with:
@@ -68,6 +92,7 @@ jobs:
type=semver,pattern={{major}}
- name: Build and push Docker image
if: steps.skip.outputs.skip_build != 'true'
id: build-and-push
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
with:
@@ -85,10 +110,12 @@ jobs:
CADDY_IMAGE=${{ steps.caddy.outputs.image }}
- name: Image digest
if: steps.skip.outputs.skip_build != 'true'
run: echo ${{ steps.build-and-push.outputs.digest }}
- name: Run Trivy scan (table output first for visibility)
if: github.event_name != 'pull_request'
&& steps.skip.outputs.skip_build != 'true'
id: trivy_table
continue-on-error: true
uses: aquasecurity/trivy-action@master
@@ -100,6 +127,7 @@ jobs:
- name: Run Trivy vulnerability scanner
if: github.event_name != 'pull_request'
&& steps.skip.outputs.skip_build != 'true'
id: trivy
continue-on-error: true
uses: aquasecurity/trivy-action@master
@@ -111,13 +139,21 @@ jobs:
severity: 'CRITICAL,HIGH'
- name: Upload Trivy results to GitHub Security
if: github.event_name != 'pull_request' && (steps.trivy.outcome == 'success' || steps.trivy.outcome == 'failure')
if: github.event_name != 'pull_request' && steps.skip.outputs.skip_build != 'true' && (steps.trivy.outcome == 'success' || steps.trivy.outcome == 'failure')
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: 'trivy-results.sarif'
- name: Check for vulnerabilities
if: github.event_name != 'pull_request' && steps.trivy_table.outcome == 'failure'
if: github.event_name != 'pull_request' && steps.skip.outputs.skip_build != 'true' && steps.trivy_table.outcome == 'failure'
run: |
echo "::error::CRITICAL or HIGH vulnerabilities found in image"
exit 1
- name: Skip summary
if: steps.skip.outputs.skip_build == 'true'
run: |
echo "## 🚫 Docker Publish Skipped" >> $GITHUB_STEP_SUMMARY
echo "Reason: renovate bot or chore(deps)/chore commit/PR title." >> $GITHUB_STEP_SUMMARY
echo "Actor: ${{ github.actor }}" >> $GITHUB_STEP_SUMMARY
echo "Event: ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY