This is an automated email from the ASF dual-hosted git repository. royteeuwen pushed a commit to branch feature/drop-third-party-docker-actions in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-committer-cli.git
commit f44660abd0670a23358b75d55e4bbd2bd302200d Author: Roy Teeuwen <[email protected]> AuthorDate: Thu Aug 20 21:56:56 2026 +0200 Remove third-party GitHub Actions from docker-push workflow and fix double image build The publish workflow pinned three docker/* actions by SHA, each of which must appear on the ASF org-level allowlist. Approved SHAs get a three-month expiry once a newer version is approved and are then removed automatically, so every pin needs periodic bumping -- and a stale pin fails as a silent "Startup failure" with no logs (see ba852b8). All three turn out to be unnecessary: * docker/setup-buildx-action was never used. docker-maven-plugin creates its own docker-container builder named "maven" and passes --builder maven to every buildx invocation; the runner-level builder the action created was torn down unused (run 32298804318). buildx itself is preinstalled on the runner at /usr/libexec/docker/cli-plugins/docker-buildx. * docker/setup-qemu-action is replaced by the binfmt container it runs internally. Emulation is genuinely required -- the arm64 stage runs apk, jlink and java -Xshare:dump. * docker/login-action is replaced by docker login --password-stdin. docker-maven-plugin resolves credentials from ~/.docker/config.json, which is exactly what the action writes. That leaves only actions/checkout and actions/setup-java, implicitly trusted as actions/* and needing no SHA pinning. Also stop building the image twice. Run 32298804318 shows docker:build at the package phase running buildx build --platform linux/amd64 ... --load and docker:push then running buildx build --platform linux/amd64,linux/arm64 ... --push with the first image discarded. -Ddocker.buildArchiveOnly=true skips it while still producing target/docker/**/tmp/docker-build.tar, which BuildXService.push() extracts as the push build context. -Ddocker.skip.build=true would not work: BuildMojo returns before the archive is created, leaving docker:push with no context (verified locally against docker-maven-plugin 0.48.1). --- .github/workflows/docker-push.yml | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-) diff --git a/.github/workflows/docker-push.yml b/.github/workflows/docker-push.yml index 70a855d..c3c5797 100644 --- a/.github/workflows/docker-push.yml +++ b/.github/workflows/docker-push.yml @@ -43,14 +43,26 @@ jobs: java-version: '21' cache: 'maven' - name: Login to Docker Hub - id: login-docker-hub - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 - with: - username: ${{ secrets.DOCKERHUB_USER }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Set up QEMU # https://github.com/docker/buildx/issues/499 - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + env: + DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }} + DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} + run: echo "$DOCKERHUB_TOKEN" | docker login --username "$DOCKERHUB_USER" --password-stdin + - name: Register QEMU handlers for arm64 emulation # https://github.com/docker/buildx/issues/499 + # The arm64 stage of the Dockerfile runs apk/jlink/java, so buildkit needs + # binfmt handlers on the host. This is what docker/setup-qemu-action does + # internally, minus the allowlisted-SHA maintenance. + run: docker run --privileged --rm tonistiigi/binfmt:latest --install arm64 - name: Push Docker image - run: mvn --batch-mode install docker:push -Ddocker.platforms=linux/amd64,linux/arm64 + # No docker/setup-buildx-action: docker-maven-plugin creates its own + # docker-container builder ("maven") and passes --builder maven to every + # buildx invocation, so a runner-level builder is never used. + # + # buildArchiveOnly skips the redundant single-platform "--load" build at + # package time while still producing target/docker/**/tmp/docker-build.tar, + # which docker:push extracts as its build context. Do NOT use + # docker.skip.build here: that returns from BuildMojo before the archive is + # created, leaving docker:push with no context. + run: > + mvn --batch-mode install docker:push + -Ddocker.platforms=linux/amd64,linux/arm64 + -Ddocker.buildArchiveOnly=true
