Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/daemon-image.yml
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ jobs:
password: ${{ secrets.GITHUB_TOKEN }}

- name: Build daemon image for scan
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: .
file: Dockerfile.daemon
Expand Down Expand Up @@ -92,7 +92,7 @@ jobs:
# finish as soon as the security gate passes.
- name: Build and publish daemon image
if: github.event_name != 'pull_request'
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: .
file: Dockerfile.daemon
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/docker.yml
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ jobs:
# Build a single-platform image locally first so Trivy can gate the push:
# CRITICAL/HIGH findings fail this job before anything reaches GHCR.
- name: Build image for scan
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: .
platforms: linux/amd64
Expand Down Expand Up @@ -87,7 +87,7 @@ jobs:
# Second build is a cache hit (layers exported by the scan build), so it
# only re-links and pushes the platform image.
- name: Build and push (amd64)
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: .
platforms: linux/amd64
Expand Down Expand Up @@ -134,7 +134,7 @@ jobs:
# Build a single-platform image locally first so Trivy can gate the push:
# CRITICAL/HIGH findings fail this job before anything reaches GHCR.
- name: Build image for scan
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: .
platforms: linux/arm64
Expand Down Expand Up @@ -165,7 +165,7 @@ jobs:
# Second build is a cache hit (layers exported by the scan build), so it
# only re-links and pushes the platform image.
- name: Build and push (arm64)
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: .
platforms: linux/arm64
Expand Down Expand Up @@ -250,7 +250,7 @@ jobs:
password: ${{ secrets.GITHUB_TOKEN }}

- name: Build sandbox image for scan
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: internal/sandbox
file: internal/sandbox/sandbox.Dockerfile
Expand All @@ -276,7 +276,7 @@ jobs:
exit-code: '1'

- name: Build and publish public sandbox image
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: internal/sandbox
file: internal/sandbox/sandbox.Dockerfile
Expand Down
Loading