From 81eb3ce692c32e8e3e87713b1c29bfae7123cf95 Mon Sep 17 00:00:00 2001 From: wind Date: Mon, 2 Mar 2026 15:05:03 +0100 Subject: [PATCH] fix: shorten APP_VERSION to 7-char git short SHA MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Was: sha- (44 chars, overlaps UI elements) Now: (e.g. abc1234) — standard git short SHA Uses a 'Set short SHA' step (GITHUB_SHA::7) before each build-push-action call in both the matrix build job and the Trivy scan job. Closes #108 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/docker.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 0e4d49c..092d3d8 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -81,6 +81,11 @@ jobs: org.opencontainers.image.vendor=talesofthemoon org.opencontainers.image.licenses=MIT + # ── Short SHA for version label ─────────────────────────────────────────── + - name: Set short SHA + id: sha + run: echo "short=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT" + # ── Build and push per-arch digest ──────────────────────────────────────── # On PRs: build only (no push, no digest needed). # On push/tag: push digest-only (no manifest tag) via outputs; the merge @@ -97,7 +102,7 @@ jobs: # On PRs: type=docker (local load, no push). On push/tag: digest-only push. outputs: ${{ github.event_name != 'pull_request' && format('type=image,name={0},push-by-digest=true,name-canonical=true,push=true', env.IMAGE) || 'type=docker' }} labels: ${{ steps.meta.outputs.labels }} - build-args: APP_VERSION=sha-${{ github.sha }} + build-args: APP_VERSION=${{ steps.sha.outputs.short }} # Per-arch GHA cache (keyed by platform so they don't collide) cache-from: type=gha,scope=${{ matrix.platform }} cache-to: type=gha,mode=max,scope=${{ matrix.platform }} @@ -136,6 +141,10 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 + - name: Set short SHA + id: sha + run: echo "short=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT" + # Build the image locally for scanning (amd64 only — same OS layers as arm64) - name: Build image for scanning uses: docker/build-push-action@v6 @@ -145,7 +154,7 @@ jobs: platforms: linux/amd64 load: true tags: networkcrawler:scan - build-args: APP_VERSION=sha-${{ github.sha }} + build-args: APP_VERSION=${{ steps.sha.outputs.short }} cache-from: type=gha,scope=linux/amd64 # Run Trivy — report CRITICAL/HIGH; results visible in Security tab without blocking merges