Skip to content

feat: add opt-out push input (lint+scan only) for pipeline testing #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
leonidgrishenkov merged 1 commit into from
Jul 17, 2026
Merged

feat: add opt-out push input (lint+scan only) for pipeline testing #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions .github/workflows/docker.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,10 @@
# REGISTRY = cr.yandex
# REGISTRY_ID = ${{ vars.YC_REGISTRY_ID }} (GitHub variable)
# PLATFORMS = linux/amd64,linux/arm64
# PUSH = always (this is a release workflow)
#
# Push is opt-out via the `push` input (default true). Set `push: false` to stop
# after lint + scan — the gate runs, nothing is pushed. Useful for testing the
# pipeline without side effects.
#
# Usage from another repo:
#
Expand All @@ -32,7 +35,7 @@
# with:
# image-name: myapp
# # optional: dockerfile, context, scan-severity,
# # smoke-test-args, provenance, sbom, registry-repo
# # smoke-test-args, provenance, sbom, registry-repo, push
# secrets: inherit # REQUIRED — forwards YC_CR_SA_AUTH_JSON (no explicit secret declared)
#
# WHY the caller must grant permissions:
Expand Down Expand Up @@ -99,6 +102,14 @@ on:
required: false
default: ''
type: string
push:
description: >-
Run the push job (multi-arch build, registry push, SBOM + SLSA provenance,
cosign sign). When false, the workflow stops after lint + scan (the gate)
— useful for testing the pipeline without pushing. Default true (release).
required: false
default: 'true'
type: string

permissions:
contents: read # least-privilege default; expanded per job below
Expand Down Expand Up @@ -274,12 +285,13 @@ jobs:
echo "| Severity gate | \`${{ inputs.scan-severity }}\` |"
echo "| Smoke test | ${{ inputs.smoke-test-args != '' && 'ran' || 'skipped' }} |"
echo "| SARIF | Security › Code scanning alerts |"
echo "| Push | → next job (multi-arch) |"
echo "| Push | ${{ inputs.push == 'true' && '→ next job (multi-arch)' || 'skipped (push=false)' }} |"
} >> "$GITHUB_STEP_SUMMARY"

push:
name: Build & push (multi-arch) + sign
needs: scan
if: ${{ inputs.push == 'true' }}
runs-on: ubuntu-latest
permissions:
contents: read
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/test-pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,4 +34,7 @@ jobs:
registry-repo: github-actions
dockerfile: testdata/Dockerfile
smoke-test-args: "/etc/pipeline-test"
# Lint + scan only — don't push the throwaway self-test image to the registry.
# Flip to 'true' (or omit) to also exercise the multi-arch push/sign job.
push: 'false'
secrets: inherit # forwards YC_CR_SA_AUTH_JSON; reads vars.YC_REGISTRY_ID
Loading