Update docker/build-push-action #3198
Conversation
WalkthroughThe GitHub Actions workflows for building and pushing various dev container Docker images were updated to use version 6 of the Changes
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (6)
.github/workflows/devcontainer-all.yaml (1)
55-63: Confirm v6 input/output parity & pin digest for reproducibility
docker/build-push-actionv6 removes some deprecated inputs and introduces new defaults (e.g.,load: trueauto-loads images). The currentwith:block (file,push,tags) is still supported, but please double-check the v6 release notes to ensure no silent behaviour changes affect this workflow.
For supply-chain stability, consider pinning to the major tag + digest, e.g.docker/build-push-action@v6@sha256:<digest>..github/workflows/devcontainer-ti.yaml (1)
55-63: Same v6 compatibility & digest pinning considerationsReplicate the v6 release-notes check and digest pinning suggestion here to maintain consistent, reproducible builds across all dev-container workflows.
.github/workflows/devcontainer-azurertos.yaml (1)
55-63: Validate behaviour change after upgrading to v6Ensure
push: trueand tag handling behave exactly as before; v6 tweaks cache-related defaults that could impact build time or registry content. Pin to a digest for immutability if possible..github/workflows/devcontainer-esp32.yml (1)
55-63: Upgrade sanity-check and optional digest pinConfirm no deprecated inputs (e.g.,
context,platforms) are implicitly relied upon. Consider locking the action to@v6@sha256:<digest>to avoid unexpected future changes..github/workflows/devcontainer-chibios.yaml (1)
55-63: Consistency check after bump to v6Double-check the ChibiOS image still builds & pushes as expected with the new major version and apply digest pinning for deterministic CI runs.
.github/workflows/devcontainer-freertos-nxp.yaml (1)
55-57: Verify v6 migration settings (provenance,sbom, cache) before merging
docker/build-push-action@v6introduces new defaults (provenance: true,sbom: true, different cache-from/to syntax).
If you don’t explicitly want provenance/SBOM generation or intend to keep the current cache behaviour, add the relevant inputs:- - name: Build and Push Docker Image - uses: docker/build-push-action@v6 + - name: Build and Push Docker Image + uses: docker/build-push-action@v6 + with: + provenance: false # disable SLSA attestation if not required + sbom: false # disable SBOM upload if not required + # cache-from / cache-to examples: + # cache-from: type=registry,ref=${{ env.CONTAINER_REPO }}/...:cache + # cache-to: type=registry,ref=${{ env.CONTAINER_REPO }}/...:cache,mode=max(Or keep them enabled deliberately—just make the choice explicit.)
Also consider pinning to a full semver tag or SHA for supply-chain safety, e.g.
docker/[email protected].
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
.github/workflows/devcontainer-all.yaml(1 hunks).github/workflows/devcontainer-azurertos.yaml(1 hunks).github/workflows/devcontainer-chibios.yaml(1 hunks).github/workflows/devcontainer-esp32.yml(1 hunks).github/workflows/devcontainer-freertos-nxp.yaml(1 hunks).github/workflows/devcontainer-ti.yaml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (17)
- GitHub Check: nf-interpreter (Nightly build) (Check_Build_Options)
- GitHub Check: nf-interpreter (Check_Build_Options)
- GitHub Check: build-target (ESP32_C3, Debug, ESP32)
- GitHub Check: build-target (TI_CC1352R1_LAUNCHXL, Debug, All, 915)
- GitHub Check: build-target (TI_CC1352R1_LAUNCHXL, Debug, TI, 915)
- GitHub Check: build-target (NXP_MIMXRT1060_EVK, Debug, All)
- GitHub Check: build-target (NXP_MIMXRT1060_EVK, Debug, FreeRTOS-NXP)
- GitHub Check: build-target (ESP32_H2_THREAD, Debug, ESP32)
- GitHub Check: build-target (M5Core2, Debug, ESP32)
- GitHub Check: build-target (ESP32_S2_USB, Debug, ESP32)
- GitHub Check: build-target (ST_STM32F769I_DISCOVERY, Debug, ChibiOS)
- GitHub Check: build-target (ESP32_C6_THREAD, Debug, ESP32)
- GitHub Check: build-target (ST_STM32F769I_DISCOVERY, Debug, All)
- GitHub Check: build-target (ESP32_S3, Debug, ESP32)
- GitHub Check: build-target (ESP_WROVER_KIT, Debug, ESP32)
- GitHub Check: build-target (SL_STK3701A, Debug, All)
- GitHub Check: build-target (SL_STK3701A, Debug, AzureRTOS)
Description
Update docker/build-push-action to V6
CI failures are due to CMSIS quota limit.
Motivation and Context
Keeps GH actions up-to-date
How Has This Been Tested?
CI
Screenshots
Types of changes
Checklist
Summary by CodeRabbit