From d19753b93aa5cb49e8cf0eaf124df82f44794b63 Mon Sep 17 00:00:00 2001 From: Roman Lemekha Date: Fri, 24 Jul 2026 19:58:34 +0200 Subject: [PATCH 1/2] feat: add optional extra-tags input to docker-publish-reusable Callers can append extra docker/metadata-action tag lines (e.g. a mirrored upstream base version) alongside the always-applied :latest. Backward compatible: defaults to empty, so existing callers are unaffected. --- .github/workflows/docker-publish-reusable.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/docker-publish-reusable.yml b/.github/workflows/docker-publish-reusable.yml index 4d0c574..ff61875 100644 --- a/.github/workflows/docker-publish-reusable.yml +++ b/.github/workflows/docker-publish-reusable.yml @@ -45,6 +45,15 @@ on: required: false type: string default: . + extra-tags: + description: | + Extra docker/metadata-action tag lines to append (newline-separated), + in addition to the always-applied `type=raw,value=latest`. Use to + mirror an upstream base version, e.g. + `type=raw,value=1.0.1369_30-05-2026`. + required: false + type: string + default: "" secrets: KOMODO_WEBHOOK_SECRET: description: HMAC secret for the Komodo stack webhook @@ -77,6 +86,7 @@ jobs: images: ${{ inputs.image }} tags: | type=raw,value=latest + ${{ inputs.extra-tags }} - name: Set up Buildx uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 From 394bfecb23968f50268a60788d49bf73e07c9fab Mon Sep 17 00:00:00 2001 From: Roman Lemekha Date: Sat, 25 Jul 2026 22:30:57 +0200 Subject: [PATCH 2/2] chore(ci): pin comments to full release versions (zizmor ref-version-mismatch) zizmor-action bump now flags '# v7'/'# v6' short comments on SHA-pinned actions. Correct them to the exact release (checkout v7.0.0, setup-node v6.4.0) repo-wide so zizmor passes. Pins (SHAs) unchanged. --- .github/workflows/dependabot-auto-merge.yml | 4 ++-- .github/workflows/docker-publish-reusable.yml | 2 +- .github/workflows/privacy-scan-reusable.yml | 4 ++-- .github/workflows/validate-renovate-reusable.yml | 4 ++-- .github/workflows/zizmor-reusable.yml | 2 +- .github/workflows/zizmor.yml | 2 +- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index d4871c1..ca1fc1e 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -23,12 +23,12 @@ jobs: name: Validate runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Setup Node.js 24.x - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '24' diff --git a/.github/workflows/docker-publish-reusable.yml b/.github/workflows/docker-publish-reusable.yml index ff61875..a9e157e 100644 --- a/.github/workflows/docker-publish-reusable.yml +++ b/.github/workflows/docker-publish-reusable.yml @@ -68,7 +68,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false diff --git a/.github/workflows/privacy-scan-reusable.yml b/.github/workflows/privacy-scan-reusable.yml index faaf58d..2008441 100644 --- a/.github/workflows/privacy-scan-reusable.yml +++ b/.github/workflows/privacy-scan-reusable.yml @@ -32,7 +32,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout caller repo - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false @@ -41,7 +41,7 @@ jobs: # caller's working tree. uses: cannot take an expression ref, so we # check the action dir out by job.workflow_sha and invoke its script. - name: Fetch scan tooling from workflows repo - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: ${{ job.workflow_repository }} ref: ${{ job.workflow_sha }} diff --git a/.github/workflows/validate-renovate-reusable.yml b/.github/workflows/validate-renovate-reusable.yml index 8d156bf..8d0ee89 100644 --- a/.github/workflows/validate-renovate-reusable.yml +++ b/.github/workflows/validate-renovate-reusable.yml @@ -28,11 +28,11 @@ jobs: validate: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 diff --git a/.github/workflows/zizmor-reusable.yml b/.github/workflows/zizmor-reusable.yml index 5c75ee3..19f0118 100644 --- a/.github/workflows/zizmor-reusable.yml +++ b/.github/workflows/zizmor-reusable.yml @@ -22,7 +22,7 @@ jobs: zizmor: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Run zizmor diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 2115419..275a64b 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -16,7 +16,7 @@ jobs: zizmor: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Run zizmor