Skip to content

ci: add Dockerfile and GitHub Actions workflow to publish to ghcr.io #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Andrei Kvapil (kvaps) merged 1 commit into from
Jun 1, 2026
Merged

ci: add Dockerfile and GitHub Actions workflow to publish to ghcr.io #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
.git
.github
*.md
LICENSE
*_test.go
talos-meta-tool
68 changes: 68 additions & 0 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
name: ci

on:
push:
branches: ["**"]
tags: ["v*"]
pull_request:

jobs:
test:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v4

@coderabbitai coderabbitai Bot Jun 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Show the workflow with line numbers around the referenced lines
nl -ba .github/workflows/docker.yaml | sed -n '1,200p'

# Check whether persist-credentials is already present anywhere in the workflow
rg -n "persist-credentials" .github/workflows/docker.yaml || true

# Show all checkout steps in the workflow for context
rg -n "uses:\s*actions/checkout@v" .github/workflows/docker.yaml -n
nl -ba .github/workflows/docker.yaml | rg -n "uses:\s*actions/checkout@v"

Repository: cozystack/talos-meta-tool

Length of output: 112

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
p = Path(".github/workflows/docker.yaml")
txt = p.read_text().splitlines()
for i, line in enumerate(txt, start=1):
    if i in {1,5,10,15,16,20,25,26,27,30,35,38,39,40,50} or "actions/checkout" in line or "persist-credentials" in line:
        print(f"{i:4d}: {line}")
PY

echo "---- persist-credentials matches ----"
rg -n "persist-credentials" .github/workflows/docker.yaml || true

echo "---- checkout@v4 matches ----"
rg -n "uses:\s*actions/checkout@v4" .github/workflows/docker.yaml || true

echo "---- checkout@v matches ----"
rg -n "uses:\s*actions/checkout@" .github/workflows/docker.yaml || true

echo "---- show file (truncated) ----"
python3 - <<'PY'
from pathlib import Path
p = Path(".github/workflows/docker.yaml")
lines = p.read_text().splitlines()
for i in range(min(len(lines),120)):
    print(f"{i+1:4d}: {lines[i]}")
PY

Repository: cozystack/talos-meta-tool

Length of output: 2829

Disable checkout credential persistence in each job.

Add with: persist-credentials: false to all actions/checkout@v4 steps in .github/workflows/docker.yaml (lines 15, 26, and 38) to avoid persisting GITHUB_TOKEN credentials into the runner’s git config.

Suggested patch 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v4
- uses: actions/checkout@v4
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.25.2)

[warning] 15-15: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 15-15: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker.yaml at line 15, Three occurrences of the checkout
step use "uses: actions/checkout@v4" and are persisting GITHUB_TOKEN into the
runner git config; update each "uses: actions/checkout@v4" step to include a
"with: persist-credentials: false" block so the checkout action does not persist
credentials (apply this to every checkout step in the workflow).

- uses: actions/setup-go@v5
Comment on lines +15 to +16

@coderabbitai coderabbitai Bot Jun 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/docker.yaml"

echo "== File head/tail for context =="
sed -n '1,120p' "$FILE" | nl -ba

echo
echo "== Exact uses: lines =="
nl -ba "$FILE" | rg -n "uses:\s*(actions/checkout@|actions/setup-go@)" -n || true

echo
echo "== persist-credentials occurrences =="
nl -ba "$FILE" | rg -n "persist-credentials" || true

echo
echo "== setup-go options block =="
# Print setup-go lines and nearby options
nl -ba "$FILE" | rg -n "uses:\s*actions/setup-go@v5" -n -C 6 || true

Repository: cozystack/talos-meta-tool

Length of output: 163

🌐 Web query:

actions/setup-go v5 default cache behavior cache option default value

💡 Result:

For actions/setup-go v5, the default cache behavior is that caching is enabled by default. 1) Cache option default value - The action input cache has a default value of true (so caching is on unless you set cache: false). [1] 2) “Default cache behavior” (what gets cached/restored) - The action includes built-in caching/restoration for Go modules and build outputs. [2] - It automatically computes the cache key from dependency files. [2] - For v5 specifically, the default dependency file used to form the Go modules cache key is go.sum in the repository root (you can change this via cache-dependency-path). [3] If you want to disable it explicitly: - uses: actions/setup-go@v5 with: cache: false Citations: default cache: true [1]; v5 caching enabled by default unless cache=false and uses go.sum in repo root for cache key [3].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail
FILE=".github/workflows/docker.yaml"

echo "== File =="
sed -n '1,120p' "$FILE"

echo
echo "== uses: (checkout/setup-go) with line numbers =="
awk '{print NR "\t" $0}' "$FILE" | rg -n "uses:\s*(actions/checkout@|actions/setup-go@)"

echo
echo "== persist-credentials occurrences =="
awk '{print NR "\t" $0}' "$FILE" | rg -n "persist-credentials"

echo
echo "== setup-go blocks (uses line + 8 lines after) =="
awk '{print NR "\t" $0}' "$FILE" | rg -n "uses:\s*actions/setup-go@" -n -C 8

Repository: cozystack/talos-meta-tool

Length of output: 1930

🌐 Web query:

actions/checkout@v4 persist-credentials default value persist-credentials false security guidance

💡 Result:

For actions/checkout@v4, the persist-credentials input’s default behavior is effectively true: the action treats a missing persist-credentials input as false in code, but the published input schema and security guidance indicate credentials are persisted unless you explicitly set persist-credentials: false. Default value (when you don’t pass persist-credentials): true (credentials are persisted unless opted out) [1][2]. What persist-credentials does: actions/checkout persists the auth token in the local git config so later steps can run authenticated git commands, then removes it during post-job cleanup; to opt out, set persist-credentials: false [1]. Security guidance: GitHub/security guidance recommends setting persist-credentials: false unless you need authenticated git operations, to reduce risk of credential exposure if the workflow is compromised [3]. Practical recommendation: - If you don’t need later steps to run authenticated git commands (push/fetch with repo-scoped credentials), use: uses: actions/checkout@v4 with: persist-credentials: false [3][1]

Citations:

🌐 Web query:

actions/setup-go v5 cache true what is cached go build cache go mod cache

💡 Result:

When cache is enabled (which is the default behavior) in actions/setup-go v5, it automatically manages both the Go module cache and the Go build cache [1][2]. Specifically, the action handles the following: - Go Module Cache: This is the directory where Go stores downloaded dependencies (typically retrieved via go mod download). The action identifies this path using the output of go env GOMODCACHE [3]. - Go Build Cache: This is the directory where Go stores build artifacts and test results to speed up subsequent builds and tests. The action identifies this path using the output of go env GOCACHE [3]. By setting cache: true, you do not need to manually configure the paths or cache keys for these directories [1][4]. The action automatically computes a cache key based on your dependency files (by default, it looks for go.mod in the repository root) [1][5]. You can customize which dependency files are used to generate the cache key by using the cache-dependency-path input [1][2].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail
FILE=".github/workflows/docker.yaml"
awk '{print NR "\t" $0}' "$FILE" | rg -n "^\s*-\s+uses:" -n

Repository: cozystack/talos-meta-tool

Length of output: 51

🏁 Script executed:

#!/bin/bash
set -euo pipefail
FILE=".github/workflows/docker.yaml"

echo "== All uses: lines (with line numbers) =="
awk '{print NR ":" $0}' "$FILE" | rg -n "uses:"
echo
echo "== Specific checkout/setup-go uses =="
awk '{print NR ":" $0}' "$FILE" | rg -n "uses: actions/(checkout|setup-go)@"
echo
echo "== persist-credentials =="
awk '{print NR ":" $0}' "$FILE" | rg -n "persist-credentials"

Repository: cozystack/talos-meta-tool

Length of output: 737

Pin all GitHub Actions to full commit SHAs (and tighten checkout/setup-go security)

  • .github/workflows/docker.yaml uses tag-pinned actions (@v4/@v5/@v7/@v3/@v6) at lines 15, 16, 26, 27, 38, 40, 42, 49, and 58; replace each uses: <action>@<tag> with uses: <action>@<full-commit-sha> to prevent tag movement.
  • actions/checkout@v4 steps (lines 15/26/38) don’t set persist-credentials: false; add it if authenticated git operations aren’t needed.
  • actions/setup-go@v5 (line 16) has default cache: true (module + build cache); disable (cache: false) for untrusted pull_request runs or otherwise constrain caching.
Example changes 
- uses: actions/checkout@v4
  with:
    persist-credentials: false
- uses: actions/setup-go@v5
  with:
    go-version-file: go.mod
    cache: false
🧰 Tools
🪛 zizmor (1.25.2)

[warning] 15-15: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 15-15: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 16-16: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 16-16: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker.yaml around lines 15 - 16, This workflow uses
tag-pinned GitHub Actions and insecure defaults; replace every uses:
<action>@<tag> (e.g., actions/checkout@v4, actions/setup-go@v5,
docker/build-push-action@v3, actions/cache@v6, actions/upload-artifact@v3, etc.)
with the corresponding full commit SHA to prevent tag movement, add with:
persist-credentials: false to each actions/checkout step when authenticated git
access is not required, and change actions/setup-go@v5 usage to include with:
cache: false (or otherwise constrain caching) and go-version-file: go.mod for
untrusted pull_request runs; ensure you update all instances across the file
consistently.

with:
go-version-file: go.mod
- run: go test ./...
Comment on lines +16 to +19

@coderabbitai coderabbitai Bot Jun 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Show the referenced workflow and surrounding lines
if [ -f .github/workflows/docker.yaml ]; then
  nl -ba .github/workflows/docker.yaml | sed -n '1,120p'
else
  echo "Missing: .github/workflows/docker.yaml"
fi

echo "----"
# Check for any other setup-go usages
rg -n "actions/setup-go@v" .github/workflows || true

echo "----"
# Check workflow triggers for docker.yaml
rg -n "^(on:|jobs:|name:)" .github/workflows/docker.yaml || true

Repository: cozystack/talos-meta-tool

Length of output: 112

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "---- docker.yaml (first 160 lines, with line numbers) ----"
if [ -f .github/workflows/docker.yaml ]; then
  cat -n .github/workflows/docker.yaml | sed -n '1,160p'
else
  echo "Missing: .github/workflows/docker.yaml"
fi

echo "---- setup-go usage in workflows ----"
rg -n "actions/setup-go@v" .github/workflows || true

echo "---- triggers in docker.yaml ----"
if [ -f .github/workflows/docker.yaml ]; then
  rg -n "^(on:|jobs:|name:)" .github/workflows/docker.yaml || true
fi

Repository: cozystack/talos-meta-tool

Length of output: 2423

🌐 Web query:

actions/setup-go v5 cache false cache key go.sum go.mod cache-dependency-path

💡 Result:

When using actions/setup-go v5, if you set the cache input to false, the action will disable its built-in caching mechanism [1][2]. Because the caching feature is disabled, the cache-dependency-path input becomes irrelevant and will not be used by the action, as there is no cache to populate or restore [2]. The cache-dependency-path input is only functional when caching is enabled (the default state, or when cache: true is set) [1][2]. In that scenario, it allows you to specify the path to your dependency files (such as go.sum or go.mod) so the action can use their hashes to generate the cache key [1][2]. If you have multiple dependency files or they are located in subdirectories, you can use glob patterns or specify multiple paths using the pipe | syntax within the cache-dependency-path input [1]. If you need to implement custom caching logic—for instance, if you require more granular control than the default behavior provides—you can set cache: false and then manually implement caching using the actions/cache action (e.g., actions/cache/restore and actions/cache/save) [3][4]. In such a manual implementation, you would then be responsible for defining the cache keys and paths, effectively bypassing the setup-go action's built-in caching configuration [3][4].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail
echo "---- .github/workflows/test.yaml (first 120 lines) ----"
if [ -f .github/workflows/test.yaml ]; then
  cat -n .github/workflows/test.yaml | sed -n '1,160p'
else
  echo "Missing test.yaml"
fi

Repository: cozystack/talos-meta-tool

Length of output: 494

Disable Go caching for pull_request workflows to avoid cache poisoning risk

Both .github/workflows/docker.yaml (job test) and .github/workflows/test.yaml run on pull_request with actions/setup-go@v5 configured only with go-version-file: go.mod (no cache: false), so the action’s default module cache behavior is enabled for untrusted PRs. Consider disabling setup-go caching for pull_request (or isolating trusted/untrusted workflows).

Suggested patch 
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
+          cache: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/setup-go@v5
with:
go-version-file: go.mod
- run: go test ./...
- uses: actions/setup-go@v5
with:
go-version-file: go.mod
cache: false
- run: go test ./...
🧰 Tools
🪛 zizmor (1.25.2)

[error] 16-16: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 16-16: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker.yaml around lines 16 - 19, The workflow uses
actions/setup-go@v5 with only go-version-file: go.mod which enables module
caching for untrusted PRs; update the test job to disable setup-go caching for
pull_request events by adding the setup-go input cache: false (or conditionally
run a step that sets cache: false when github.event_name == 'pull_request'), so
replace the current actions/setup-go@v5 step to include with: go-version-file:
go.mod and cache: false (or gate the step with an if check) to prevent cache
poisoning on PRs.


lint:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v4
- uses: golangci/golangci-lint-action@v7
with:
version: v2.12.2

docker:
needs: [test, lint]
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
Comment on lines +31 to +38
- uses: actions/checkout@v4

- uses: docker/setup-buildx-action@v3

- uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- uses: docker/metadata-action@v5
id: meta
with:
images: ghcr.io/${{ github.repository }}
tags: |
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=semver,pattern={{major}}
type=raw,value=latest,enable={{is_default_branch}}
type=ref,event=tag

- uses: docker/build-push-action@v6
with:
context: .
platforms: linux/amd64,linux/arm64
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
Comment on lines +38 to +66
cache-from: type=gha
cache-to: type=gha,mode=max
15 changes: 0 additions & 15 deletions .github/workflows/lint.yaml
View file
Open in desktop

This file was deleted.

16 changes: 0 additions & 16 deletions .github/workflows/test.yaml
View file
Open in desktop

This file was deleted.

12 changes: 12 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
FROM golang:1.26.3-alpine AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
ARG TARGETARCH
RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
go build -trimpath -ldflags="-s -w" -o /talos-meta-tool .

FROM scratch
COPY --from=builder /talos-meta-tool /talos-meta-tool
ENTRYPOINT ["/talos-meta-tool"]
Loading