Publish Docker image to ghcr.io on master push#4
Conversation
Co-authored-by: fffaraz <895678+fffaraz@users.noreply.github.com> Agent-Logs-Url: https://github.com/fffaraz/fakessh/sessions/8b5d6af6-abdc-4f4b-8aab-bba0f17e7fd0
There was a problem hiding this comment.
Pull request overview
Updates the existing Docker GitHub Actions workflow so that images are built on PRs but are published to GitHub Container Registry (ghcr.io) when changes are pushed to master.
Changes:
- Add job-level
packages: writepermission to enable publishing to GHCR. - Replace the manual
docker buildstep with Buildx +docker/build-push-action@v6. - Add GHCR login and
docker/metadata-action@v5-driven tagging, pushing only onpushevents.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| permissions: | ||
| contents: read | ||
| packages: write |
There was a problem hiding this comment.
packages: write is granted for the entire job, including pull_request runs. Even though the workflow doesn’t push on PRs, least-privilege is to avoid write-scoped tokens when executing PR code. Consider splitting into two jobs (PR build with read-only permissions, push job with packages: write and if: github.event_name == 'push'), or moving the publishing steps into a separate workflow triggered only on push to master with elevated permissions.
The Docker workflow only built the image locally and never published it. Updated to push to GitHub Container Registry after successful builds on master.
docker buildwithdocker/build-push-action@v6docker/login-action@v3usingGITHUB_TOKEN(no external secrets needed)latest(on default branch) and short SHA viadocker/metadata-action@v5pushevents to master; PR builds remain build-onlypackages: writepermission to enable ghcr.io push⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.