feat: optional GitHub Action dockerImage entry point

[tknopp-ld]

Summary

• Adds an opt-in Action entry point at launchdarkly/find-code-references/docker with a dockerImage input so workflows can pull the scanner from a private registry or Docker Hub proxy.
• Leaves the root Docker container Action (action.yml + Dockerfile) unchanged so existing uses: launchdarkly/find-code-references@v2 workflows keep the current GitHub-managed runtime.
• Fail-fast checks for GITHUB_WORKSPACE, GITHUB_EVENT_PATH, and docker CLI; release copy script now preserves nested metadata (docker/).

Why not change the root Action

GitHub does not allow dynamic runs.image / ${{ inputs.* }} on using: docker Actions (docs, SO).

Usage (after publish to find-code-references)

- uses: docker/login-action@v3
  with:
    registry: your.registry.example
    username: ${{ secrets.REGISTRY_USER }}
    password: ${{ secrets.REGISTRY_TOKEN }}
- uses: launchdarkly/find-code-references/docker@v2.17.0
  with:
    accessToken: ${{ secrets.LD_ACCESS_TOKEN }}
    projKey: LD_PROJECT_KEY
    dockerImage: your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.16.0

Test plan

Composite + docker run can fail quietly (green CI, wrong/empty data in LD) if mounts or env are wrong. Test on a real GitHub-hosted runner (not only act), against a repo that already has known flag refs in LD.

0. Hygiene

• git diff main -- build/metadata/github-actions/action.yml Dockerfile is empty (root Action unchanged)
• Manual dry-run of release copy: cp -a build/metadata/github-actions/. /tmp/fcr-test/ includes docker/action.yml

1. Baseline parity (default Hub image)

Workflow A — /docker with no dockerImage (uses default Hub tag):

- uses: actions/checkout@v4
  with:
    fetch-depth: 11
- uses: ./build/metadata/github-actions/docker   # or published .../docker@branch
  with:
    accessToken: ${{ secrets.LD_ACCESS_TOKEN }}
    projKey: <known project>
    debug: true

Workflow B — same job, root Action (control):

- uses: ./build/metadata/github-actions   # or launchdarkly/find-code-references@v2.16.0
  with:
    accessToken: ${{ secrets.LD_ACCESS_TOKEN }}
    projKey: <known project>
    debug: true

Assert:

• Both jobs exit 0
• Logs show the same branch name (not empty / not wrong PR head)
• Hunk / flag counts are in the same ballpark (debug table or LD UI for that branch)
• GITHUB_EVENT_PATH / workspace fail-fasts do not fire

Failure modes this catches: missing workspace mount (empty scan), missing event/ref (wrong branch).

2. Explicit Hub URI

• Set dockerImage: launchdarkly/ld-find-code-refs-github-action:2.16.0 explicitly — same results as §1

3. Mirrored registry

• Mirror/retag that image into a registry we control (GHCR or internal)
• docker/login-action then /docker with dockerImage: <mirror URI>
• Job pulls from the mirror (check logs for registry host) and produces same branch + similar ref counts as §1

Failure modes this catches: login ordering, wrong image tag, private pull auth.

4. Lookback / extinctions (git history in the container)

• fetch-depth: 11, lookback: 10 (defaults)
• Logs show extinction lookback running without “unable to generate flag extinctions” / git errors caused by missing .git
• Prefer a branch where a flag was recently removed so an extinction can appear (or at least the lookback path executes cleanly)

Failure modes this catches: workspace mount without .git, shallow-clone mismatch.

5. Defaults parity vs CLI footguns

• Omit prune input — confirm behavior matches root Action (prune false), not CLI default true (check logs: should not attempt remote prune on a private repo unless enabled)
• Omit optional inputs — lookback/contextLines behave like root defaults

6. Negative / fail-loud checks (should be red, not silent)

• Temporarily break workspace (e.g. skip checkout) — step fails with GITHUB_WORKSPACE error
• Empty dockerImage: "" — step fails with empty-image error
• (Optional) Self-hosted without Docker — fails with docker CLI missing

7. Exit codes

• Invalid accessToken / unreachable API with ignoreServiceErrors: false — non-zero exit (not swallowed by the composite wrapper)
• ignoreServiceErrors: true — still respects scanner behavior (exit 0 on service errors)

8. Release follow-up

• Publish docker/ into launchdarkly/find-code-references, tag (e.g. v2.17.0)
• Re-run §1–§3 against the published uses: launchdarkly/find-code-references/docker@... (not local path)

Made with Cursor

[ember-stevens]

Suggested change

	Action, but runs via docker run so you can override the image registry
	Action, but runs using docker run so you can override the image registry