Skip to content

fix: enable Docker Buildx to eliminate legacy builder deprecation warnings #461

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix: enable Docker Buildx to eliminate legacy builder deprecation warnings #461

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dd82af7
fix: enable Docker Buildx to eliminate legacy builder deprecation war…
jnewton03 Nov 21, 2025
f9e8d32
fix: add Docker Buildx to scout job in trivy.yml
jnewton03 Nov 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,10 @@
- name: Setup Docker on macOS
if: matrix.os == 'macos-15-intel'
uses: douglascamata/[email protected]


- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium test

Unpinned 3rd party Action 'Test Dockerfiles' step
Uses Step
Loading
uses 'docker/setup-buildx-action' with ref 'v3', not a pinned commit hash
Comment on lines +40 to +41
Copy link

@coderabbitai coderabbitai bot Nov 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

❓ Verification inconclusive

Address unpinned tag in docker/setup-buildx-action to meet supply chain security best practices.

The CodeQL static analysis tool has flagged that docker/setup-buildx-action@v3 uses a mutable tag instead of an immutable commit hash. Version tags can be re-tagged or updated, creating a supply chain risk. Pinning to a specific commit SHA (e.g., docker/setup-buildx-action@abc123def456...) is the security best practice for Actions, even if this pattern exists in other workflows in the repo.

Confirm whether this unpinned-tag pattern is accepted as part of your organization's GitHub Actions security policy. If stricter pinning is required, you can find the commit SHA for v3 at https://github.com/docker/setup-buildx-action/releases/tag/v3.

I'll verify the security claims in this review by searching for GitHub Actions best practices.

Let me verify if there are any organizational security policies in the codebase that would clarify the context of this review.

I've verified the review comment against current GitHub Actions security best practices and real-world data. Here are my findings:

Key verification results:

Although pinning to a commit SHA is the most secure option, version tags can be moved or deleted if a bad actor gains access to the repository storing the action. The review comment's claim about mutability is correct.

The popular GitHub Action tj-actions/changed-files was compromised in March 2025, with all tags tampered to point to a revision with malicious code. This demonstrates the real-world risk is not theoretical.

GitHub recommends that workflows pin dependency versions to a specific commit SHA to prevent malicious code added to a new or updated branch or tag from being automatically used.

Docker's setup-buildx-action is manually verified by GitHub as an official partner organization, making it from a trusted source—but this doesn't eliminate the supply chain risk identified in the review.

Address unpinned tag in docker/setup-buildx-action to meet supply chain security best practices.

Pinning an action to a full-length commit SHA is currently the only way to use an action as an immutable release. Update line 41 from docker/setup-buildx-action@v3 to pin to a commit SHA (e.g., docker/setup-buildx-action@abc123def...) and include a comment referencing the v3 tag to aid future dependency updates.

🏁 Script executed:

#!/bin/bash
# Search for security policy files or documentation
fd -i 'security\|policy\|codeql' --type f -e md -e yml -e yaml -e txt

Length of output: 0

Pin docker/setup-buildx-action to a commit SHA instead of the v3 version tag.

Version tags like v3 are mutable and can be retagged or updated, creating a supply chain risk. Pin to a specific commit SHA (available at https://github.com/docker/setup-buildx-action/releases/tag/v3) to ensure you're running a known, immutable version. This is the recommended security practice for GitHub Actions.

🧰 Tools
🪛 GitHub Check: CodeQL

[warning] 41-41: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Test Dockerfiles' step Uses Step uses 'docker/setup-buildx-action' with ref 'v3', not a pinned commit hash

🤖 Prompt for AI Agents 
.github/workflows/test.yml lines 40-41: the workflow currently uses the mutable
tag "docker/setup-buildx-action@v3"; replace it with the specific commit SHA for
the v3 release to pin the action to an immutable version. Retrieve the commit
SHA from the v3 release page
(https://github.com/docker/setup-buildx-action/releases/tag/v3) and update the
"uses" reference to the full repo@SHA format so the workflow runs a fixed,
auditable commit.


- name: Build an image from ${{ matrix.dockerfile }}
run: |
docker build -f ${{ matrix.dockerfile }} -t liquibase/liquibase:${{ github.sha }} .
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/trivy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,9 @@
,/vault/liquibase
parse-json-secrets: true

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Vulnerability Scanning' step
Uses Step
Loading
uses 'docker/setup-buildx-action' with ref 'v3', not a pinned commit hash

- name: Build ${{ matrix.image.name }}${{ matrix.image.suffix }} from Dockerfile
run: |
docker build -f ${{ matrix.image.dockerfile }} -t ${{ matrix.image.name }}${{ matrix.image.suffix }}:${{ github.sha }} .
Expand Down Expand Up @@ -118,6 +121,9 @@
- name: Checkout code
uses: actions/checkout@v6

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Vulnerability Scanning' step
Uses Step
Loading
uses 'docker/setup-buildx-action' with ref 'v3', not a pinned commit hash

- name: Build ${{ matrix.image.name }}${{ matrix.image.suffix }} from Dockerfile
run: |
docker build -f ${{ matrix.image.dockerfile }} -t ${{ matrix.image.name }}${{ matrix.image.suffix }}:${{ github.sha }} .
Expand Down
Loading