fix: Implement no-cache Docker builds to eliminate false positive vulnerabilities from cached layers

This commit is contained in:
GitHub Actions
2026-01-11 20:39:57 +00:00
parent 622f5a48e4
commit d8cc4da730
4 changed files with 685 additions and 3 deletions

View File

@@ -126,9 +126,8 @@ jobs:
load: ${{ github.event_name == 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
no-cache: true # Prevent false positive vulnerabilities from cached layers
pull: true # Always pull fresh base images to get latest security patches
cache-from: type=gha
cache-to: type=gha,mode=max
build-args: |
VERSION=${{ steps.meta.outputs.version }}
BUILD_DATE=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
@@ -459,7 +458,7 @@ jobs:
- name: Build image locally for PR
run: |
docker build -t charon:pr-${{ github.sha }} .
docker build --no-cache -t charon:pr-${{ github.sha }} .
- name: Extract `charon` binary from image
run: |