ci: add container content diff #845
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
There was a problem hiding this comment.
Pull Request Overview
Adds a CI step to generate and upload a semantic diff of container contents using diffoci.
- Download and run diffoci to compare edge vs. versioned container
- Save output to
container-diff.jsonand upload it as a workflow artifact
Comments suppressed due to low confidence (3)
.github/workflows/wc-build-push.yml:173
- [nitpick] Pinning the action by a commit SHA works, but using the semantic version tag (e.g.,
actions/[email protected]) improves readability and eases future upgrades.
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
.github/workflows/wc-build-push.yml:165
- [nitpick] Adding a
name:field for this step (e.g.,Run diffoci semantic diff) would make the workflow more self-documenting in CI logs.
- run: |
.github/workflows/wc-build-push.yml:167
- Consider verifying the downloaded
diffocibinary with a checksum or signature to ensure its integrity and prevent supply-chain attacks.
wget -O diffoci https://github.com/reproducible-containers/diffoci/releases/download/v0.1.7/diffoci-v0.1.7.linux-amd64
Contributor
Contributor
🦙 MegaLinter status:
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 18 | 0 | 0 | 0.6s | |
| ✅ DOCKERFILE | hadolint | 2 | 0 | 0 | 0.76s | |
| ✅ GHERKIN | gherkin-lint | 2 | 0 | 0 | 1.03s | |
| ✅ JSON | npm-package-json-lint | yes | no | no | 0.38s | |
| ✅ JSON | prettier | 16 | 1 | 0 | 0 | 0.47s |
| ✅ JSON | v8r | 16 | 0 | 0 | 7.16s | |
| ✅ MARKDOWN | markdownlint | 9 | 0 | 0 | 0 | 0.89s |
| ✅ MARKDOWN | markdown-table-formatter | 9 | 0 | 0 | 0 | 0.23s |
| ✅ REPOSITORY | checkov | yes | no | no | 16.61s | |
| ✅ REPOSITORY | gitleaks | yes | no | no | 0.4s | |
| ✅ REPOSITORY | git_diff | yes | no | no | 0.01s | |
| grype | yes | no | 1 | 23.44s | ||
| ✅ REPOSITORY | secretlint | yes | no | no | 0.98s | |
| ✅ REPOSITORY | syft | yes | no | no | 1.98s | |
| ✅ REPOSITORY | trivy | yes | no | no | 6.85s | |
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.24s | |
| ✅ REPOSITORY | trufflehog | yes | no | no | 3.27s | |
| ✅ SPELL | lychee | 63 | 0 | 0 | 2.57s | |
| ✅ YAML | prettier | 24 | 0 | 0 | 0 | 0.97s |
| ✅ YAML | v8r | 24 | 0 | 0 | 6.58s | |
| ✅ YAML | yamllint | 24 | 0 | 0 | 1.06s |
See detailed report in MegaLinter reports
Contributor
📦 Container Size AnalysisComparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisComparing 📈 Size Comparison Table
|
EkelmansPh
approved these changes
Jul 2, 2025
wget creates a .wget-hsts file to keep track of HSTS. This makes the container build non-reproducable. Since we use https for all endpoints anyway disable hsts for wget altogether.
|
Contributor
Pull Request Report (#845)Static measures
Time related measures
Status check related measures
|
Contributor
|
🎉 Hooray! The changes in this pull request went live with the release of v6.2.0 🎉 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🚀 Hey, I have created a Pull Request
Description of changes
This PR adds a container content diff to the build steps. Having the ability to diff the created images to the
edgebaseline has the benefit of seeing exactly what changed in a new image version. This has several uses:✔️ Checklist