Skip to content

feat: Add support for pinning Docker images in GitHub Actions files#27

Merged
azu merged 8 commits intomainfrom
claude/fix-dockerfile-pin-IGtdL
Apr 3, 2026
Merged

feat: Add support for pinning Docker images in GitHub Actions files#27
azu merged 8 commits intomainfrom
claude/fix-dockerfile-pin-IGtdL

Conversation

@azu
Copy link
Copy Markdown
Owner

@azu azu commented Apr 3, 2026 •
edited
Loading

Summary

This PR extends dockerfile-pin to support GitHub Actions workflow files and action metadata files, enabling users to pin Docker image references in .github/workflows/*.yml, action.yml, and action.yaml files with digest hashes.

Key Changes

  • New Actions Parser (internal/actions/parse.go): Parses GitHub Actions YAML files to extract Docker image references from:

    • Workflow job container images (both object and string formats)
    • Workflow job services images
    • Workflow step uses with docker:// prefix
    • Action metadata runs.image with docker:// prefix
    • Properly handles existing digests and the docker:// prefix convention

  • Actions File Rewriter (internal/actions/rewrite.go): Applies resolved digests back to Actions files while preserving formatting and handling both prefixed and non-prefixed image references

  • File Type Detection (cmd/files.go): Extended DetectFileType() to recognize:

    • Files in .github/workflows/ directories with .yml/.yaml extensions
    • action.yml and action.yaml files anywhere in the repository

  • Pin Command Integration (cmd/pin.go): Added applyActions() function to handle digest application for Actions files, respecting the --update flag for already-pinned images

  • Check Command Integration (cmd/check.go): Added parseActionsForCheck() function to validate image pinning status in Actions files with proper reporting of missing/invalid digests

  • Comprehensive Test Coverage:

    • Unit tests for parsing various Actions file formats (internal/actions/parse_test.go)
    • Unit tests for rewriting logic (internal/actions/rewrite_test.go)
    • End-to-end integration tests in e2e_test.go covering workflows, actions, and round-trip file modifications
    • File detection tests in cmd/files_test.go

  • Documentation (README.md): Updated to reflect support for GitHub Actions files

Implementation Details

  • The parser uses gopkg.in/yaml.v3 to maintain line number information for accurate file rewriting
  • Image references are extracted with their raw form (including docker:// prefix if present) and normalized form (without prefix/digest)
  • Existing digests are preserved and can be updated with the --update flag
  • Local Dockerfile references in action metadata are skipped (not treated as remote images)
  • Non-docker action steps (e.g., actions/checkout@v4) are correctly ignored

close #24

claude and others added 2 commits April 3, 2026 10:38
@claude @azu
feat: support GitHub Actions workflow files and action files
b84741e 
Add support for pinning Docker image references in GitHub Actions
workflow files (.github/workflows/*.yml) and action metadata files
(action.yml/action.yaml).

Supported locations:
- jobs.<job_id>.container.image (including string shorthand)
- jobs.<job_id>.services.<service_id>.image
- jobs.<job_id>.steps[*].uses (docker:// prefixed only)
- runs.image (docker:// prefixed only, in action files)

The default glob pattern now auto-discovers these files alongside
Dockerfiles and compose files.

Closes #24

https: //claude.ai/code/session_0189LYEmTuZSS2ZCUoDurv8M
Co-authored-by: azu <azu@users.noreply.github.com>
@claude @azu
docs: update README with GitHub Actions support
a83564f 
Add supported patterns tables for workflow files and action files,
update description and default glob pattern documentation.

https: //claude.ai/code/session_0189LYEmTuZSS2ZCUoDurv8M
Co-authored-by: azu <azu@users.noreply.github.com>
@azu azu added the Type: Feature New Feature label Apr 3, 2026
@azu azu marked this pull request as ready for review April 3, 2026 10:59
@claude @azu
test: use exact expected output in Actions E2E tests
8594cf2 
Replace strings.Contains checks with full output comparison
for more reliable regression detection. Also fix goimports lint.

https: //claude.ai/code/session_0189LYEmTuZSS2ZCUoDurv8M
Co-authored-by: azu <azu@users.noreply.github.com>
devin-ai-integration[bot]
devin-ai-integration Bot reviewed Apr 3, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@devin-ai-integration devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.

Open in Devin Review

@claude @azu
fix: handle docker:// prefix in container fields and return skip ref …
ac78800 
…for local Dockerfile

- parseContainer now detects docker:// prefix and strips it from ImageRef
- parseAction returns a skip ref (Skip: true, SkipReason: "local Dockerfile")
  for non-docker:// runs.image values, matching compose package behavior

https: //claude.ai/code/session_0189LYEmTuZSS2ZCUoDurv8M
Co-authored-by: azu <azu@users.noreply.github.com>
devin-ai-integration[bot]

This comment was marked as resolved.

Sign in to view

claude and others added 4 commits April 3, 2026 11:52
@claude @azu
fix: handle docker:// prefix in service image fields
de037da 
Same fix as container fields — detect docker:// prefix in
services.*.image and pass it to makeRef so the prefix is
stripped from ImageRef before registry resolution.

https: //claude.ai/code/session_0189LYEmTuZSS2ZCUoDurv8M
Co-authored-by: azu <azu@users.noreply.github.com>
@claude @azu
refactor: auto-detect docker:// prefix in makeRef to prevent omissions
238a80e 
Move docker:// prefix detection into makeRef itself instead of
requiring each caller to check. This eliminates the class of bugs
where a new call site forgets to detect the prefix (as happened
with services.*.image).

https: //claude.ai/code/session_0189LYEmTuZSS2ZCUoDurv8M
Co-authored-by: azu <azu@users.noreply.github.com>
@claude @azu
fix: add YAML key prefix to Actions check output for consistency
48d7bc3 
Actions check output now shows "image: node:24" and
"uses: docker://..." instead of bare values, matching the
compose convention of "image: <ref>".

https: //claude.ai/code/session_0189LYEmTuZSS2ZCUoDurv8M
Co-authored-by: azu <azu@users.noreply.github.com>
@claude @azu
test: add E2E test for docker:// prefix in container and service fields
5e138fa 
Verifies the full parse → resolve → rewrite flow when container
and service images use the docker:// prefix, ensuring the prefix
is stripped before resolution but preserved in output.

https: //claude.ai/code/session_0189LYEmTuZSS2ZCUoDurv8M
Co-authored-by: azu <azu@users.noreply.github.com>
@azu azu changed the title Add support for pinning Docker images in GitHub Actions files feat: Add support for pinning Docker images in GitHub Actions files Apr 3, 2026
@azu azu merged commit 98aae53 into main Apr 3, 2026
3 checks passed
@azu azu deleted the claude/fix-dockerfile-pin-IGtdL branch April 3, 2026 12:04
@github-actions github-actions Bot mentioned this pull request Apr 3, 2026
Merged
azu pushed a commit that referenced this pull request Apr 3, 2026
@github-actions
Release v1.1.0 (#29)
9842d02 
<!-- Release notes generated using configuration in .github/release.yml
at main -->

## What's Changed
### Features
* feat: Add support for pinning Docker images in GitHub Actions files by
@azu in #27
### Maintenance
* fix: remove unused --platform flag by @azu in
#25


**Full Changelog**:
v1.0.5...v1.1.0

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@devin-ai-integration devin-ai-integration[bot] devin-ai-integration[bot] left review comments

Assignees

No one assigned

Labels

Type: Feature New Feature

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

feat: Support GitHub Actions workflow files and action files

2 participants

@azu @claude