feat: create new gh action to retag container image #1
Conversation
WalkthroughThis pull request introduces a new GitHub Action called "Image Retag." The action automates the process of pulling a container image from a source, tagging it with a new identifier, and then pushing the retagged image to a target registry. It uses a composite run structure with three sequential steps and requires two input parameters: Changes
Sequence Diagram(s)sequenceDiagram
participant Action as "Image Retag Action"
participant Docker as "Docker Registry"
Action->>Docker: Pull image (image_source)
Action->>Action: Tag the image as (image_target)
Action->>Docker: Push image (image_target)
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/actions/image-retag/action.yml (2)
3-10: Consider adding input validation for image parameters.While the input parameters are well-defined, consider adding pattern validation to ensure the image references follow valid Docker image naming conventions.
Add pattern validation using this diff:
inputs: image_source: description: 'The source image to pull.' required: true + pattern: '^[a-zA-Z0-9]+([._-][a-zA-Z0-9]+)*(/[a-zA-Z0-9]+([._-][a-zA-Z0-9]+)*)*:[a-zA-Z0-9]+([._-][a-zA-Z0-9]+)*$' image_target: description: 'The target image to tag and push.' required: true + pattern: '^[a-zA-Z0-9]+([._-][a-zA-Z0-9]+)*(/[a-zA-Z0-9]+([._-][a-zA-Z0-9]+)*)*:[a-zA-Z0-9]+([._-][a-zA-Z0-9]+)*$'
22-22: Add newline at end of file.Add a newline character at the end of the file to comply with YAML standards.
🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 22-22: no new line character at the end of file
(new-line-at-end-of-file)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/actions/image-retag/action.yml(1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.35.1)
.github/actions/image-retag/action.yml
[error] 22-22: no new line character at the end of file
(new-line-at-end-of-file)
🔇 Additional comments (1)
.github/actions/image-retag/action.yml (1)
1-2: LGTM!The action name and description are clear and descriptive.
| runs: | ||
| using: composite | ||
| steps: | ||
| - name: Pull docker images | ||
| shell: bash | ||
| run: docker pull ${{ inputs.image_source }} | ||
| - name: Tag docker images | ||
| shell: bash | ||
| run: docker tag ${{ inputs.image_source }} ${{ inputs.image_target }} | ||
| - name: Push docker images | ||
| shell: bash | ||
| run: docker push ${{ inputs.image_target }} |
There was a problem hiding this comment.
💡 Verification agent
🛠️ Refactor suggestion
🧩 Analysis chain
Add error handling and registry authentication support.
The current implementation has the following limitations:
- No error handling for docker commands
- No support for authenticating with private registries
Consider these improvements:
runs:
using: composite
steps:
+ - name: Check docker daemon
+ shell: bash
+ run: |
+ if ! docker info > /dev/null 2>&1; then
+ echo "Error: Docker daemon is not running"
+ exit 1
+ fi
+ - name: Docker login
+ shell: bash
+ run: |
+ if [[ "${{ inputs.image_source }}" == *"docker.io"* ]] || [[ "${{ inputs.image_target }}" == *"docker.io"* ]]; then
+ echo "Please configure DOCKER_USERNAME and DOCKER_PASSWORD secrets if pulling from or pushing to Docker Hub"
+ fi
- name: Pull docker images
shell: bash
- run: docker pull ${{ inputs.image_source }}
+ run: |
+ if ! docker pull ${{ inputs.image_source }}; then
+ echo "Error: Failed to pull image ${{ inputs.image_source }}"
+ exit 1
+ fi
- name: Tag docker images
shell: bash
- run: docker tag ${{ inputs.image_source }} ${{ inputs.image_target }}
+ run: |
+ if ! docker tag ${{ inputs.image_source }} ${{ inputs.image_target }}; then
+ echo "Error: Failed to tag image ${{ inputs.image_source }} as ${{ inputs.image_target }}"
+ exit 1
+ fi
- name: Push docker images
shell: bash
- run: docker push ${{ inputs.image_target }}
+ run: |
+ if ! docker push ${{ inputs.image_target }}; then
+ echo "Error: Failed to push image ${{ inputs.image_target }}"
+ exit 1
+ fiLet's verify if there are any best practices or recommendations for Docker authentication in GitHub Actions:
🌐 Web query:
What are the best practices for Docker authentication in GitHub Actions?
💡 Result:
To ensure secure and efficient Docker authentication in GitHub Actions workflows, follow these best practices based on industry standards and official documentation:
Credential Management
- Use GitHub Secrets for storing sensitive credentials like Docker access tokens[1][5][9]
- Avoid password authentication - use personal access tokens (PATs) instead of account passwords[5][7]
- Create separate credentials with:
- Read-only access for pull operations
- Write access only for CI/CD pipelines needing push privileges[6]
Authentication Methods
For different container registries:
| Registry | Authentication Method |
|---|---|
| Docker Hub | username: ${{ secrets.DOCKERHUB_USERNAME }}, password: ${{ secrets.DOCKERHUB_TOKEN }}[2][5] |
| GHCR | Use automatic GITHUB_TOKEN[2][10] or PAT with repo/write:packages scope[5][10] |
| AWS ECR | Use AWS credentials or temporary tokens via configure-aws-credentials action[2][5] |
| Google GCR/GAR | Workload Identity Federation or JSON key authentication[2][5][6] |
| Azure ACR | Service principal credentials[2][5] |
Security Best Practices
-
Principle of Least Privilege
- Restrict
GITHUB_TOKENpermissions[3][6][8]
permissions: contents: read packages: write
- Restrict
-
Third-Party Action Security
- Pin actions to full-length commit SHA instead of tags[6][8]
- Audit actions from Marketplace before use[8]
-
Workflow Hardening
- Use environment-specific secrets[6]
- Avoid string interpolation in
runsteps[6]
# Unsafe - run: echo "Using secret ${{ secrets.MY_SECRET }}" # Safe - run: echo "Using secret" env: MY_SECRET: ${{ secrets.MY_SECRET }}
Cross-Registry Authentication Example
- name: Login to multiple registries
uses: docker/login-action@v3
with:
registry: |
ghcr.io
docker.io
username: |
${{ github.actor }}
${{ vars.DOCKERHUB_USERNAME }}
password: |
${{ secrets.GITHUB_TOKEN }}
${{ secrets.DOCKERHUB_PAT }}Advanced Configurations
- For AWS Public ECR:
- uses: docker/login-action@v3 with: registry: public.ecr.aws username: ${{ secrets.AWS_ACCESS_KEY_ID }} password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
- For Google Artifact Registry using Workload Identity:
- uses: google-github-actions/auth@v1 with: workload_identity_provider: projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider service_account: [email protected] - uses: docker/login-action@v3 with: registry: us-docker.pkg.dev username: oauth2accesstoken password: ${{ steps.auth.outputs.access_token }}
Implementing these practices ensures secure credential handling while maintaining workflow efficiency across different container registries[2][5][6][8]. Regularly audit your workflows using tools like OpenSSF Scorecards and GitHub's built-in security features to maintain compliance with evolving security standards[8].
Citations:
- 1: https://docs.docker.com/guides/gha/
- 2: https://cicube.io/workflow-hub/docker-login-action/
- 3: https://www.stepsecurity.io/blog/github-actions-security-best-practices
- 4: https://github.com/orgs/community/discussions/76636
- 5: https://github.com/marketplace/actions/docker-login
- 6: https://blog.gitguardian.com/github-actions-security-cheat-sheet/
- 7: https://github.com/docker/login-action
- 8: https://docs.github.com/actions/security-guides/security-hardening-for-github-actions
- 9: https://www.docker.com/blog/docker-github-actions/
- 10: https://docs.github.com/packages/working-with-a-github-packages-registry/working-with-the-container-registry
Key Improvements Required: Robust error handling and secure Docker registry authentication.
The current composite action lacks proper error handling for Docker operations and does not actually authenticate with registries using secure credentials. Based on recent best practices:
- Docker Daemon Check: Confirm that the Docker daemon is running before executing any Docker commands.
- Registry Authentication: Instead of only warning about Docker Hub, perform an actual login using GitHub Secrets (e.g.,
DOCKERHUB_USERNAMEandDOCKERHUB_TOKEN), which aligns with industry recommendations. - Command Error Handling: Each Docker command (pull, tag, push) should verify success and abort on failure.
- File Formatting: Append a newline at the end of the file to satisfy static analysis requirements.
Below is an updated diff snippet incorporating these suggestions:
runs:
using: composite
steps:
+ - name: Check Docker Daemon
+ shell: bash
+ run: |
+ if ! docker info > /dev/null 2>&1; then
+ echo "Error: Docker daemon is not running"
+ exit 1
+ fi
+ - name: Docker Login (for Docker Hub)
+ shell: bash
+ env:
+ DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+ DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+ run: |
+ if [[ "${{ inputs.image_source }}" == *"docker.io"* ]] || [[ "${{ inputs.image_target }}" == *"docker.io"* ]]; then
+ echo "Logging into Docker Hub"
+ if ! docker login -u "$DOCKERHUB_USERNAME" -p "$DOCKERHUB_TOKEN"; then
+ echo "Error: Docker login failed"
+ exit 1
+ fi
+ fi
- name: Pull docker images
shell: bash
- run: docker pull ${{ inputs.image_source }}
+ run: |
+ if ! docker pull ${{ inputs.image_source }}; then
+ echo "Error: Failed to pull image ${{ inputs.image_source }}"
+ exit 1
+ fi
- name: Tag docker images
shell: bash
- run: docker tag ${{ inputs.image_source }} ${{ inputs.image_target }}
+ run: |
+ if ! docker tag ${{ inputs.image_source }} ${{ inputs.image_target }}; then
+ echo "Error: Failed to tag image ${{ inputs.image_source }} as ${{ inputs.image_target }}"
+ exit 1
+ fi
- name: Push docker images
shell: bash
- run: docker push ${{ inputs.image_target }}
+ run: |
+ if ! docker push ${{ inputs.image_target }}; then
+ echo "Error: Failed to push image ${{ inputs.image_target }}"
+ exit 1
+ fiAdditional Note: Ensure the file ends with a newline.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| runs: | |
| using: composite | |
| steps: | |
| - name: Pull docker images | |
| shell: bash | |
| run: docker pull ${{ inputs.image_source }} | |
| - name: Tag docker images | |
| shell: bash | |
| run: docker tag ${{ inputs.image_source }} ${{ inputs.image_target }} | |
| - name: Push docker images | |
| shell: bash | |
| run: docker push ${{ inputs.image_target }} | |
| runs: | |
| using: composite | |
| steps: | |
| - name: Check Docker Daemon | |
| shell: bash | |
| run: | | |
| if ! docker info > /dev/null 2>&1; then | |
| echo "Error: Docker daemon is not running" | |
| exit 1 | |
| fi | |
| - name: Docker Login (for Docker Hub) | |
| shell: bash | |
| env: | |
| DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} | |
| DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} | |
| run: | | |
| if [[ "${{ inputs.image_source }}" == *"docker.io"* ]] || [[ "${{ inputs.image_target }}" == *"docker.io"* ]]; then | |
| echo "Logging into Docker Hub" | |
| if ! docker login -u "$DOCKERHUB_USERNAME" -p "$DOCKERHUB_TOKEN"; then | |
| echo "Error: Docker login failed" | |
| exit 1 | |
| fi | |
| fi | |
| - name: Pull docker images | |
| shell: bash | |
| run: | | |
| if ! docker pull ${{ inputs.image_source }}; then | |
| echo "Error: Failed to pull image ${{ inputs.image_source }}" | |
| exit 1 | |
| fi | |
| - name: Tag docker images | |
| shell: bash | |
| run: | | |
| if ! docker tag ${{ inputs.image_source }} ${{ inputs.image_target }}; then | |
| echo "Error: Failed to tag image ${{ inputs.image_source }} as ${{ inputs.image_target }}" | |
| exit 1 | |
| fi | |
| - name: Push docker images | |
| shell: bash | |
| run: | | |
| if ! docker push ${{ inputs.image_target }}; then | |
| echo "Error: Failed to push image ${{ inputs.image_target }}" | |
| exit 1 | |
| fi | |
🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 22-22: no new line character at the end of file
(new-line-at-end-of-file)
| description: 'The source image to pull.' | ||
| required: true | ||
| image_target: | ||
| description: 'The target image to tag and push.' |
There was a problem hiding this comment.
nits: removed the quotation for consistency and the article that I feel is redundant because every input will end up needing articles. Unless you want to emphasis it, we don't need articles.
- Technical Writing One introduction | Google for Developers
- They didn't mention it directly, but their docs already explains it.
| description: 'The source image to pull.' | |
| required: true | |
| image_target: | |
| description: 'The target image to tag and push.' | |
| description: Source image to pull. | |
| required: true | |
| image_target: | |
| description: Target image to tag and push. |
There was a problem hiding this comment.
Also, I'd like to ask you to remove the period in the description for consistency.
Ref:
- GitHub Actions composite action example: Creating a composite action
| runs: | ||
| using: composite | ||
| steps: | ||
| - name: Pull docker images |
There was a problem hiding this comment.
nits: proper product name and make it singular.
| - name: Pull docker images | |
| - name: Pull Docker image |
| - name: Pull docker images | ||
| shell: bash | ||
| run: docker pull ${{ inputs.image_source }} | ||
| - name: Tag docker images |
There was a problem hiding this comment.
| - name: Tag docker images | |
| - name: Tag Docker image |
| - name: Tag docker images | ||
| shell: bash | ||
| run: docker tag ${{ inputs.image_source }} ${{ inputs.image_target }} | ||
| - name: Push docker images |
There was a problem hiding this comment.
| - name: Push docker images | |
| - name: Push Docker image |
| image_source: | ||
| description: 'The source image to pull.' | ||
| required: true | ||
| image_target: |
There was a problem hiding this comment.
I think the action name already explains what it does, so maybe we don't need the prefix image_.
| image_source: | |
| description: 'The source image to pull.' | |
| required: true | |
| image_target: | |
| source: | |
| description: 'The source image to pull.' | |
| required: true | |
| target: |
IMHO, even in the example below, people can understand that the source and the target are for images.
- uses: .../image-retag
with:
source: reearth
target: reearth-mirror| run: docker tag ${{ inputs.image_source }} ${{ inputs.image_target }} | ||
| - name: Push docker images | ||
| shell: bash | ||
| run: docker push ${{ inputs.image_target }} |
There was a problem hiding this comment.
nits: last line.
| run: docker push ${{ inputs.image_target }} | |
| run: docker push ${{ inputs.image_target }} | |
Summary by CodeRabbit