bedatty · Mar 24, 2026 · Mar 20, 2026 · Mar 20, 2026 · Mar 20, 2026 · Mar 20, 2026
@@ -51,7 +51,7 @@
         uses: actions/checkout@v6
 
       - name: Run branch cleanup
-        uses: LerianStudio/github-actions-shared-workflows/src/config/branch-cleanup@develop
+        uses: LerianStudio/github-actions-shared-workflows/src/config/branch-cleanup@v1.18.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           stale-days: ${{ inputs.stale_days }}

@@ -122,6 +122,10 @@
         description: 'Force multi-platform build (amd64+arm64) even for beta/rc tags'
         type: boolean
         default: false
+      build_context_from_working_dir:
+        description: 'Use the component working_dir as Docker build context instead of build_context. Useful for independent modules (e.g., tools with their own go.mod).'
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -139,7 +143,7 @@
       - name: Get changed paths (monorepo)
         if: inputs.filter_paths != ''
         id: changed-paths
-        uses: LerianStudio/github-actions-shared-workflows/src/config/changed-paths@develop
+        uses: LerianStudio/github-actions-shared-workflows/src/config/changed-paths@v1.18.0
         with:
           filter-paths: ${{ inputs.filter_paths }}
           shared-paths: ${{ inputs.shared_paths }}
@@ -281,7 +285,7 @@
       - name: Build and push Docker image
         uses: docker/build-push-action@v7
         with:
-          context: ${{ inputs.build_context }}
+          context: ${{ inputs.build_context_from_working_dir == true && matrix.app.working_dir || inputs.build_context }}
           file: ${{ matrix.app.working_dir }}/${{ inputs.dockerfile_name }}
           platforms: ${{ needs.prepare.outputs.platforms }}
           push: true

@@ -52,9 +52,9 @@ on:
         type: string
         default: 'v4.44.3'
       enable_docker_login:
-        description: 'Enable Docker Hub login to avoid rate limits'
+        description: 'Enable Docker Hub login to avoid rate limits. Disabled by default since GitOps updates do not require Docker registry access.'
         type: boolean
-        default: true
+        default: false
       configmap_updates:
         description: 'JSON object mapping artifact names to configmap keys (e.g., {"pix.tag": ".pix.configmap.VERSION"})'
         type: string
@@ -104,7 +104,7 @@ jobs:
           # Determine which servers to deploy to
           DEPLOY_FIRMINO="${{ inputs.deploy_in_firmino }}"
           DEPLOY_CLOTILDE="${{ inputs.deploy_in_clotilde }}"
-          
+
           echo "deploy_firmino=$DEPLOY_FIRMINO" >> "$GITHUB_OUTPUT"
           echo "deploy_clotilde=$DEPLOY_CLOTILDE" >> "$GITHUB_OUTPUT"
           echo "Deploy to Firmino: $DEPLOY_FIRMINO"
@@ -144,7 +144,7 @@ jobs:
         shell: bash
         run: |
           set -e
-          cd gitops
+          cd gitops || exit 1
           git pull origin main
 
       - name: Cleanup old artifacts (self-hosted runner safety)
@@ -179,25 +179,25 @@ jobs:
         shell: bash
         run: |
           echo "Checking for downloaded artifacts..."
-          
+
           # Check if directory exists and has files
           if [[ ! -d ".gitops-tags" ]]; then
             echo "::error::No artifacts directory found. Build job may have been skipped or failed to produce artifacts."
             echo "artifacts_valid=false" >> "$GITHUB_OUTPUT"
             exit 1
           fi
-          
+
           # Count actual artifact files (not directories)
           ARTIFACT_COUNT=$(find .gitops-tags -type f -name "*.tag" 2>/dev/null | wc -l || echo "0")
-          
+
           if [[ "$ARTIFACT_COUNT" -eq 0 ]]; then
             echo "::error::No artifact files found in .gitops-tags/. Build job may have been skipped or failed."
             echo "Directory contents:"
             ls -laR .gitops-tags/ 2>/dev/null || echo "Directory is empty or doesn't exist"
             echo "artifacts_valid=false" >> "$GITHUB_OUTPUT"
             exit 1
           fi
-          
+
           echo "Found $ARTIFACT_COUNT artifact file(s):"
           ls -la .gitops-tags/
           echo "artifacts_valid=true" >> "$GITHUB_OUTPUT"
@@ -210,7 +210,7 @@ jobs:
 
           # Get app name
           APP_NAME="${{ steps.setup.outputs.app_name }}"
-          
+
           # Determine environments to update based on tag type
           if [[ "${{ env.IS_BETA }}" == "true" ]]; then
             ENVIRONMENTS="dev"
@@ -244,7 +244,7 @@ jobs:
               SERVERS="clotilde"
             fi
           fi
-          
+
           if [[ -z "$SERVERS" ]]; then
             echo "No servers selected for deployment. Enable deploy_in_firmino or deploy_in_clotilde."
             exit 1
@@ -262,7 +262,7 @@ jobs:
               AVAILABLE_ARTIFACTS="${AVAILABLE_ARTIFACTS}${artifact_name} "
             fi
           done
-          
+
           if [[ -z "$AVAILABLE_ARTIFACTS" ]]; then
             echo "No artifacts found in .gitops-tags/"
             echo "sync_matrix=[]" >> "$GITHUB_OUTPUT"
@@ -280,10 +280,10 @@ jobs:
             local file="$1"
             local yaml_path="$2"
             local new_tag="$3"
-            
+
             # Extract the key name from yaml path (e.g., ".image.tag" -> "tag")
             local key_name="${yaml_path##*.}"
-            
+
             # Use sed to replace only the tag value, preserving all formatting
             # This handles patterns like "tag: v1.0.0" or "tag: 'v1.0.0'" or 'tag: "v1.0.0"'
             if grep -q "^[[:space:]]*${key_name}:" "$file"; then
@@ -298,21 +298,21 @@ jobs:
           for SERVER in $SERVERS; do
             for ENV in $ENVIRONMENTS; do
               VALUES_FILE="gitops/environments/${SERVER}/helmfile/applications/${ENV}/${APP_NAME}/values.yaml"
-              
+
               echo ""
               echo "Processing: $SERVER/$ENV"
               echo "  Path: $VALUES_FILE"
-              
+
               # Check if file exists
               if [[ ! -f "$VALUES_FILE" ]]; then
                 echo "  WARNING: Values file not found for ${SERVER}/${ENV}: ${VALUES_FILE}"
                 MISSING_FILES="${MISSING_FILES}${SERVER}/${ENV}:${VALUES_FILE}\n"
                 continue
               fi
-              
+
               # Track if any changes were made to this file
               FILE_CHANGED=false
-              
+
               # Apply mappings from inputs - only if artifact exists
               MAPPINGS='${{ inputs.yaml_key_mappings }}'
               while IFS='|' read -r artifact_key yaml_key; do
@@ -334,7 +334,7 @@ jobs:
                   fi
                 fi
               done < <(echo "$MAPPINGS" | jq -r 'to_entries[] | "\(.key)|\(.value)"')
-              
+
               # Apply configmap updates if configured - only if artifact exists
               if [[ -n "${{ inputs.configmap_updates }}" ]]; then
                 CONFIGMAP_MAPPINGS='${{ inputs.configmap_updates }}'
@@ -356,7 +356,7 @@ jobs:
                   fi
                 done < <(echo "$CONFIGMAP_MAPPINGS" | jq -r 'to_entries[] | "\(.key)|\(.value)"')
               fi
-              
+
               # Only track as updated if changes were actually made
               if [[ "$FILE_CHANGED" == "true" ]]; then
                 UPDATED_FILES="${UPDATED_FILES}${VALUES_FILE}\n"
@@ -378,7 +378,7 @@ jobs:
           else
             echo "No files were updated"
           fi
-          
+
           if [[ -n "$MISSING_FILES" ]]; then
             echo ""
             echo "Missing files (skipped):"
@@ -388,7 +388,7 @@ jobs:
           # Save updated servers/envs for ArgoCD sync - only include files that actually changed
           if [[ -n "$UPDATED_SERVERS_ENVS" ]]; then
             echo -e "$UPDATED_SERVERS_ENVS" | grep -v '^$' > /tmp/updated_servers_envs.txt
-            
+
             # Output sync targets as JSON array for matrix job
             SYNC_MATRIX=$(echo -e "$UPDATED_SERVERS_ENVS" | grep -v '^$' | while IFS=: read -r s e; do
               [[ -n "$s" && -n "$e" ]] && echo "{\"server\":\"$s\",\"env\":\"$e\"}"
@@ -400,7 +400,7 @@ jobs:
             echo "sync_matrix=[]" >> "$GITHUB_OUTPUT"
             echo "has_sync_targets=false" >> "$GITHUB_OUTPUT"
           fi
-          
+
           COUNT=0
           if [[ -n "$UPDATED_FILES" ]]; then
             COUNT=$(echo -e "$UPDATED_FILES" | grep -c -v '^$' || true)
@@ -410,7 +410,7 @@ jobs:
       - name: Show git diff
         shell: bash
         run: |
-          cd gitops
+          cd gitops || exit 1
           echo "Changes to be committed:"
           git diff --stat
           echo ""
@@ -432,17 +432,17 @@ jobs:
       - name: Commit & push (GitOps)
         run: |
           set -e
-          cd gitops
-          
+          cd gitops || exit 1
+
           # Get env label from apply_tags step
           ENV_LABEL="${{ steps.apply_tags.outputs.env_label }}"
-          
+
           # Check if there are changes to commit
           if git diff --quiet; then
             echo "No changes to commit"
             exit 0
           fi
-          
+
           git commit -am "ci(${{ steps.setup.outputs.commit_prefix }}): update image tags ($ENV_LABEL)" || echo "No changes to commit"
           git push origin main
 

@@ -126,7 +126,7 @@
           name: coverage-report
 
       - name: Go Coverage Comment
-        uses: fgrosse/go-coverage-report@v1.2.0
+        uses: fgrosse/go-coverage-report@v1.3.0
         with:
           coverage-artifact-name: coverage-report
           coverage-file-name: coverage.txt

@@ -333,7 +333,7 @@
 
       - name: Run Gosec for SARIF
         id: gosec-sarif
-        uses: securego/gosec@v2.24.7
+        uses: securego/gosec@v2.25.0
         with:
           args: -no-fail -fmt sarif -out gosec-${{ matrix.app.name }}.sarif ./${{ matrix.app.working_dir }}/...
 

@@ -146,7 +146,7 @@
       - name: Get changed paths (monorepo)
         if: (steps.check-tag.outputs.is_stable == 'true' || inputs.stable_releases_only == false) && inputs.filter_paths != ''
         id: changed-paths
-        uses: LerianStudio/github-actions-shared-workflows/src/config/changed-paths@develop
+        uses: LerianStudio/github-actions-shared-workflows/src/config/changed-paths@v1.18.0
         with:
           filter-paths: ${{ inputs.filter_paths }}
           shared-paths: ${{ inputs.shared_paths }}

@@ -44,7 +44,7 @@
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Sync labels
-        uses: LerianStudio/github-actions-shared-workflows/src/config/labels-sync@develop
+        uses: LerianStudio/github-actions-shared-workflows/src/config/labels-sync@v1.18.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           config: ${{ inputs.config || '.github/labels.yml' }}

@@ -67,6 +67,10 @@
         description: 'Enable Docker Hub Health Score compliance checks (non-root user, CVEs, licenses)'
         type: boolean
         default: true
+      build_context_from_working_dir:
+        description: 'Use the component working_dir as Docker build context instead of repo root. Useful for independent modules (e.g., tools with their own go.mod).'
+        type: boolean
+        default: false
 
 permissions:
   id-token: write       # Required for OIDC authentication
@@ -91,7 +95,7 @@
       # ----------------- Detect Changes & Build Matrix -----------------
       - name: Get changed paths
         id: changed-paths
-        uses: LerianStudio/github-actions-shared-workflows/src/config/changed-paths@develop
+        uses: LerianStudio/github-actions-shared-workflows/src/config/changed-paths@v1.18.0
         with:
           filter-paths: ${{ inputs.filter_paths }}
           shared-paths: ${{ inputs.shared_paths }}
@@ -141,7 +145,7 @@
       - name: Trivy Filesystem Scan
         id: fs-scan
         if: always()
-        uses: LerianStudio/github-actions-shared-workflows/src/security/trivy-fs-scan@develop
+        uses: LerianStudio/github-actions-shared-workflows/src/security/trivy-fs-scan@v1.18.0
         with:
           scan-ref: ${{ matrix.working_dir }}
           app-name: ${{ env.APP_NAME }}
@@ -151,7 +155,7 @@
         if: always() && inputs.enable_docker_scan
         uses: docker/build-push-action@v7
         with:
-          context: ${{ inputs.monorepo_type == 'type2' && matrix.working_dir == inputs.frontend_folder && inputs.frontend_folder || '.' }}
+          context: ${{ inputs.build_context_from_working_dir == true && matrix.working_dir || (inputs.monorepo_type == 'type2' && matrix.working_dir == inputs.frontend_folder && inputs.frontend_folder || '.') }}
           file: ${{ env.DOCKERFILE_PATH }}
           platforms: linux/amd64
           load: true
@@ -165,7 +169,7 @@
       - name: Trivy Image Scan
         id: image-scan
         if: always() && inputs.enable_docker_scan
-        uses: LerianStudio/github-actions-shared-workflows/src/security/trivy-image-scan@develop
+        uses: LerianStudio/github-actions-shared-workflows/src/security/trivy-image-scan@v1.18.0
         with:
           image-ref: '${{ env.DOCKERHUB_ORG }}/${{ env.APP_NAME }}:pr-scan-${{ github.sha }}'
           app-name: ${{ env.APP_NAME }}
@@ -175,15 +179,15 @@
       - name: Dockerfile Compliance Checks
         id: dockerfile-checks
         if: always() && inputs.enable_docker_scan && inputs.enable_health_score
-        uses: LerianStudio/github-actions-shared-workflows/src/security/dockerfile-checks@develop
+        uses: LerianStudio/github-actions-shared-workflows/src/security/dockerfile-checks@v1.18.0
         with:
           dockerfile-path: ${{ env.DOCKERFILE_PATH }}
 
       # ----------------- Results & Security Gate -----------------
       - name: Post Security Scan Results to PR
         id: post-results
         if: always() && github.event_name == 'pull_request'
-        uses: LerianStudio/github-actions-shared-workflows/src/security/pr-security-reporter@develop
+        uses: LerianStudio/github-actions-shared-workflows/src/security/pr-security-reporter@v1.18.0
         with:
           github-token: ${{ secrets.MANAGE_TOKEN || secrets.GITHUB_TOKEN }}
           app-name: ${{ env.APP_NAME }}
@@ -215,7 +219,7 @@
     runs-on: ${{ inputs.runner_type }}
     steps:
       - name: Slack Notification
-        uses: LerianStudio/github-actions-shared-workflows/src/notify/slack-notify@develop
+        uses: LerianStudio/github-actions-shared-workflows/src/notify/slack-notify@v1.18.0
         with:
           webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
           status: ${{ needs.security_scan.result }}

@@ -138,7 +138,7 @@
             exit 1
           fi
           echo "Resolved release tag: $TAG"
-          echo "tag=$TAG" >> $GITHUB_OUTPUT
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
       - name: Dry run summary
         if: ${{ inputs.dry_run }}
@@ -162,7 +162,7 @@
 
       - name: Discord notification
         if: ${{ env.DISCORD_WEBHOOK_URL != '' }}
-        uses: LerianStudio/github-actions-shared-workflows/src/notify/discord-release@develop
+        uses: LerianStudio/github-actions-shared-workflows/src/notify/discord-release@v1.18.0
         with:
           webhook-url: ${{ secrets.DISCORD_WEBHOOK_URL }}
           release-tag: ${{ steps.release.outputs.tag }}
@@ -174,7 +174,7 @@
 
       - name: Slack notification
         if: ${{ env.SLACK_WEBHOOK_URL != '' && inputs.slack_channel != '' }}
-        uses: LerianStudio/github-actions-shared-workflows/src/notify/slack-release@develop
+        uses: LerianStudio/github-actions-shared-workflows/src/notify/slack-release@v1.18.0
         with:
           webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
           channel: ${{ inputs.slack_channel }}

@@ -60,7 +60,7 @@
       - name: Get changed paths (monorepo)
         if: inputs.filter_paths != ''
         id: changed-paths
-        uses: LerianStudio/github-actions-shared-workflows/src/config/changed-paths@develop
+        uses: LerianStudio/github-actions-shared-workflows/src/config/changed-paths@v1.18.0
         with:
           filter-paths: ${{ inputs.filter_paths }}
           shared-paths: ${{ inputs.shared_paths }}