Repository navigation
ci: stop the E2E image builds from printing the GitHub event payload - #977
Merged
Merged
Conversation
…(PER-17677) buildx writes min-mode provenance into the build's metadata file, and build-push-action prints that file. Its invocation environment holds the whole event payload, which on a pull_request run is the PR title and description as they were when the run started. BUILDX_METADATA_PROVENANCE=disabled turns it off for the two E2E jobs, which build images only to load them locally. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for opal-docs canceled.
|
zeevmoney
approved these changes
Oct 22, 2026
zeevmoney
left a comment
zeevmoney
left a comment
Member
There was a problem hiding this comment.
Approved — no CRITICAL or HIGH issues found.
Non-blocking:
- LOW
.github/workflows/tests.yml:101— set the variable once at workflow level so new build jobs are covered - LOW
.github/workflows/tests.yml:105— comment: the payload is the triggering event's (re-runs reuse it), and only the docker-container builder adds it
Details are in the inline comments on each line.
…accurate comment A build job added later is covered too. The comment names the docker-container builder (buildx >= 0.30) that adds the payload, and says it is the triggering event's, which a re-run reuses. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linear: PER-17677
Why
docker/build-push-actionprints the build's metadata file in aMetadatalog group. With the docker-container builder thatsetup-buildx-actioncreates, buildx (>= 0.30) adds the GitHub event payload to the build's provenance and writes that provenance into the file even in its defaultminmode. Itsinvocation.environmentthen holdsgithub_event_payload, the whole triggering event. On apull_requestrun that's the PR's title and description from the event that triggered the run (a re-run reuses it), so everyE2E TestsandE2E Tests (Alpine)job copies the PR description into this repo's public logs. Editing the description later doesn't remove it from there.What
BUILDX_METADATA_PROVENANCE: disabledin a workflow-levelenv:block, so a build job added to this workflow later is covered too. Thebuildandcijobs don't run buildx, so it changes nothing for them. Theirbuild-push-action@v2steps only load the images locally for the tests. v2 has noprovenanceinput and builds no attestation, so the variable is the only change needed.on_release.ymlis unchanged. Whether release images carry provenance is a separate decision.Verification
pre-commithooks pass ontests.yml.github_event_payloadoccurrences to 0.E2E TestsandE2E Tests (Alpine)logs each still print twoMetadatagroups, now with 0buildx.build.provenanceand 0github_event_payload.ad20692, variable at workflow level): both E2E logs have nogithub_event_payload.🤖 Generated with Claude Code