From 547010ca87e780f9ba0de7b86cca786ef8e4fa32 Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Tue, 6 Oct 2026 16:55:04 +0200 Subject: [PATCH 1/3] Adopt fixed-only Grype scanning --- .github/workflows/stackpacks-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/stackpacks-ci.yml b/.github/workflows/stackpacks-ci.yml index 14a3774..a0ebaa9 100644 --- a/.github/workflows/stackpacks-ci.yml +++ b/.github/workflows/stackpacks-ci.yml @@ -269,7 +269,7 @@ jobs: fi - name: Scan image - uses: StackVista/image-pipeline/.github/actions/scan-image@f7e766e074b516bb754891a240e6ab2df1e60e4c + uses: StackVista/image-pipeline/.github/actions/scan-image@ec325c73909d0d00420121bbde6754b964e80ac3 # fixed-only Grype (#52) with: image: ${{ steps.local-image.outputs.ref }} mode: inform From 841a67108610425c7492213090ff58a7fb7ed53c Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Tue, 6 Oct 2026 16:56:34 +0200 Subject: [PATCH 2/3] Use main label for scan action pin --- .github/workflows/stackpacks-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/stackpacks-ci.yml b/.github/workflows/stackpacks-ci.yml index a0ebaa9..801c88f 100644 --- a/.github/workflows/stackpacks-ci.yml +++ b/.github/workflows/stackpacks-ci.yml @@ -269,7 +269,7 @@ jobs: fi - name: Scan image - uses: StackVista/image-pipeline/.github/actions/scan-image@ec325c73909d0d00420121bbde6754b964e80ac3 # fixed-only Grype (#52) + uses: StackVista/image-pipeline/.github/actions/scan-image@ec325c73909d0d00420121bbde6754b964e80ac3 # main with: image: ${{ steps.local-image.outputs.ref }} mode: inform From 3e766c981f42ccfdccc1a154eabc6a0debb347cb Mon Sep 17 00:00:00 2001 From: Remco Beckers Date: Tue, 6 Oct 2026 19:03:05 +0200 Subject: [PATCH 3/3] Skip publication of existing image tags --- .github/workflows/stackpacks-ci.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/.github/workflows/stackpacks-ci.yml b/.github/workflows/stackpacks-ci.yml index 801c88f..ab4a90a 100644 --- a/.github/workflows/stackpacks-ci.yml +++ b/.github/workflows/stackpacks-ci.yml @@ -277,7 +277,25 @@ jobs: with-grype: true upload-sarif: false + - name: Check whether image needs publication + id: publish + env: + IMAGE_REF: quay.io/stackstate/contrib-stackpacks:${{ steps.tag.outputs.value }} + run: | + error=$(mktemp) + trap 'rm -f "${error}"' EXIT + if docker buildx imagetools inspect "${IMAGE_REF}" >/dev/null 2>"${error}"; then + echo 'required=false' >> "${GITHUB_OUTPUT}" + echo "::notice::Image ${IMAGE_REF} is already published" + elif grep -Eq '(^|: )(not found|manifest unknown)(:|$)' "${error}"; then + echo 'required=true' >> "${GITHUB_OUTPUT}" + else + cat "${error}" >&2 + exit 1 + fi + - name: Apply OCI labels + if: steps.publish.outputs.required == 'true' id: oci-labels uses: StackVista/image-pipeline/.github/actions/apply-oci-labels@f7e766e074b516bb754891a240e6ab2df1e60e4c with: @@ -290,6 +308,7 @@ jobs: base-name: registry.suse.com/bci/bci-minimal:15.7-26.60 - name: Push single-arch image (amd64) + if: steps.publish.outputs.required == 'true' uses: StackVista/image-pipeline/.github/actions/push-single-arch@f7e766e074b516bb754891a240e6ab2df1e60e4c with: image: quay.io/stackstate/contrib-stackpacks @@ -303,6 +322,7 @@ jobs: target-registry-password: ${{ secrets.QUAY_PASSWORD }} - name: Push single-arch image (arm64) + if: steps.publish.outputs.required == 'true' uses: StackVista/image-pipeline/.github/actions/push-single-arch@f7e766e074b516bb754891a240e6ab2df1e60e4c with: image: quay.io/stackstate/contrib-stackpacks @@ -316,6 +336,7 @@ jobs: target-registry-password: ${{ secrets.QUAY_PASSWORD }} - name: Merge multi-arch manifest + if: steps.publish.outputs.required == 'true' uses: StackVista/image-pipeline/.github/actions/merge-multiarch@f7e766e074b516bb754891a240e6ab2df1e60e4c with: image: quay.io/stackstate/contrib-stackpacks