From 0d34cd68680f871c21285f28aa7be31576c92868 Mon Sep 17 00:00:00 2001
From: Leonid Grishenkov <grishenkovleonid@proton.me>
Date: Fri, 17 Jul 2026 19:49:06 +0300
Subject: [PATCH] feat: add opt-out `push` input (lint+scan only) for pipeline
 testing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The reusable workflow previously always ran the push job (multi-arch
build, registry push, SBOM+SLSA, cosign sign). Add a `push` input
(default 'true' to preserve the release contract) and gate the push job
on `inputs.push == 'true'`. Set `push: false` to stop after lint +
scan — the gate still runs, nothing is pushed.

Set the self-test workflow (test-pipeline.yml) to push: false so it
exercises lint + scan + smoke without pushing a throwaway image. Flip
to true (or omit) to also test push/sign.
---
 .github/workflows/docker.yaml       | 18 +++++++++++++++---
 .github/workflows/test-pipeline.yml |  3 +++
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
index bb5b8bc..b162c2f 100644
--- a/.github/workflows/docker.yaml
+++ b/.github/workflows/docker.yaml
@@ -18,7 +18,10 @@
 #   REGISTRY     = cr.yandex
 #   REGISTRY_ID  = ${{ vars.YC_REGISTRY_ID }}    (GitHub variable)
 #   PLATFORMS    = linux/amd64,linux/arm64
-#   PUSH         = always (this is a release workflow)
+#
+# Push is opt-out via the `push` input (default true). Set `push: false` to stop
+# after lint + scan — the gate runs, nothing is pushed. Useful for testing the
+# pipeline without side effects.
 #
 # Usage from another repo:
 #
@@ -32,7 +35,7 @@
 #       with:
 #         image-name: myapp
 #         # optional: dockerfile, context, scan-severity,
-#         #           smoke-test-args, provenance, sbom, registry-repo
+#         #           smoke-test-args, provenance, sbom, registry-repo, push
 #       secrets: inherit    # REQUIRED — forwards YC_CR_SA_AUTH_JSON (no explicit secret declared)
 #
 # WHY the caller must grant permissions:
@@ -99,6 +102,14 @@ on:
         required: false
         default: ''
         type: string
+      push:
+        description: >-
+          Run the push job (multi-arch build, registry push, SBOM + SLSA provenance,
+          cosign sign). When false, the workflow stops after lint + scan (the gate)
+          — useful for testing the pipeline without pushing. Default true (release).
+        required: false
+        default: 'true'
+        type: string
 
 permissions:
   contents: read   # least-privilege default; expanded per job below
@@ -274,12 +285,13 @@ jobs:
             echo "| Severity gate | \`${{ inputs.scan-severity }}\` |"
             echo "| Smoke test | ${{ inputs.smoke-test-args != '' && 'ran' || 'skipped' }} |"
             echo "| SARIF | Security › Code scanning alerts |"
-            echo "| Push | → next job (multi-arch) |"
+            echo "| Push | ${{ inputs.push == 'true' && '→ next job (multi-arch)' || 'skipped (push=false)' }} |"
           } >> "$GITHUB_STEP_SUMMARY"
 
   push:
     name: Build & push (multi-arch) + sign
     needs: scan
+    if: ${{ inputs.push == 'true' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/.github/workflows/test-pipeline.yml b/.github/workflows/test-pipeline.yml
index 6e6ec54..b44b0bb 100644
--- a/.github/workflows/test-pipeline.yml
+++ b/.github/workflows/test-pipeline.yml
@@ -34,4 +34,7 @@ jobs:
       registry-repo: github-actions
       dockerfile: testdata/Dockerfile
       smoke-test-args: "/etc/pipeline-test"
+      # Lint + scan only — don't push the throwaway self-test image to the registry.
+      # Flip to 'true' (or omit) to also exercise the multi-arch push/sign job.
+      push: 'false'
     secrets: inherit    # forwards YC_CR_SA_AUTH_JSON; reads vars.YC_REGISTRY_ID