From 917d20bd9d945f03ad42ae4686ca9f960d790c70 Mon Sep 17 00:00:00 2001 From: KaelSensei Date: Tue, 24 Mar 2026 14:05:58 +0100 Subject: [PATCH] fix(ci): build Docker images on PRs, push only on main Removes the job-level `if: github.ref == 'refs/heads/main'` guard from all six build-and-push jobs. The Docker build now runs on every PR so a broken Dockerfile is caught before merge. The GHCR login and push remain conditional on main so no credentials are needed during PR builds. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/ci-analyzer.yml | 4 ++-- .github/workflows/ci-api.yml | 4 ++-- .github/workflows/ci-collector.yml | 4 ++-- .github/workflows/ci-dashboard.yml | 4 ++-- .github/workflows/ci-notifier.yml | 4 ++-- .github/workflows/ci-subscription.yml | 4 ++-- CHANGELOG.md | 12 ++++++++++++ PROGRESS.md | 7 +++---- 8 files changed, 27 insertions(+), 16 deletions(-) diff --git a/.github/workflows/ci-analyzer.yml b/.github/workflows/ci-analyzer.yml index 2bb7a8a..4655c3e 100644 --- a/.github/workflows/ci-analyzer.yml +++ b/.github/workflows/ci-analyzer.yml @@ -55,7 +55,6 @@ jobs: name: Build & Push Docker runs-on: ubuntu-latest needs: lint-and-test - if: github.ref == 'refs/heads/main' permissions: contents: read packages: write @@ -64,6 +63,7 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 - name: Log in to GHCR + if: github.ref == 'refs/heads/main' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} @@ -81,7 +81,7 @@ jobs: uses: docker/build-push-action@v6 with: context: services/analyzer - push: true + push: ${{ github.ref == 'refs/heads/main' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha diff --git a/.github/workflows/ci-api.yml b/.github/workflows/ci-api.yml index 0aac54a..8f9b228 100644 --- a/.github/workflows/ci-api.yml +++ b/.github/workflows/ci-api.yml @@ -48,7 +48,6 @@ jobs: name: Build & Push Docker runs-on: ubuntu-latest needs: lint-and-test - if: github.ref == 'refs/heads/main' permissions: contents: read packages: write @@ -57,6 +56,7 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 - name: Log in to GHCR + if: github.ref == 'refs/heads/main' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} @@ -74,7 +74,7 @@ jobs: uses: docker/build-push-action@v6 with: context: services/api - push: true + push: ${{ github.ref == 'refs/heads/main' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha diff --git a/.github/workflows/ci-collector.yml b/.github/workflows/ci-collector.yml index 348f6b9..7879808 100644 --- a/.github/workflows/ci-collector.yml +++ b/.github/workflows/ci-collector.yml @@ -55,7 +55,6 @@ jobs: name: Build & Push Docker runs-on: ubuntu-latest needs: lint-and-test - if: github.ref == 'refs/heads/main' permissions: contents: read packages: write @@ -64,6 +63,7 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 - name: Log in to GHCR + if: github.ref == 'refs/heads/main' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} @@ -81,7 +81,7 @@ jobs: uses: docker/build-push-action@v6 with: context: services/collector - push: true + push: ${{ github.ref == 'refs/heads/main' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha diff --git a/.github/workflows/ci-dashboard.yml b/.github/workflows/ci-dashboard.yml index 6635c0a..bc22f16 100644 --- a/.github/workflows/ci-dashboard.yml +++ b/.github/workflows/ci-dashboard.yml @@ -42,7 +42,6 @@ jobs: name: Build & Push Docker runs-on: ubuntu-latest needs: lint-and-build - if: github.ref == 'refs/heads/main' permissions: contents: read packages: write @@ -51,6 +50,7 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 - name: Log in to GHCR + if: github.ref == 'refs/heads/main' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} @@ -68,7 +68,7 @@ jobs: uses: docker/build-push-action@v6 with: context: dashboard - push: true + push: ${{ github.ref == 'refs/heads/main' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha diff --git a/.github/workflows/ci-notifier.yml b/.github/workflows/ci-notifier.yml index 13cdd04..34c8c37 100644 --- a/.github/workflows/ci-notifier.yml +++ b/.github/workflows/ci-notifier.yml @@ -51,7 +51,6 @@ jobs: name: Build & Push Docker runs-on: ubuntu-latest needs: lint-and-test - if: github.ref == 'refs/heads/main' permissions: contents: read packages: write @@ -60,6 +59,7 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 - name: Log in to GHCR + if: github.ref == 'refs/heads/main' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} @@ -77,7 +77,7 @@ jobs: uses: docker/build-push-action@v6 with: context: services/notifier - push: true + push: ${{ github.ref == 'refs/heads/main' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha diff --git a/.github/workflows/ci-subscription.yml b/.github/workflows/ci-subscription.yml index 9179803..5caac15 100644 --- a/.github/workflows/ci-subscription.yml +++ b/.github/workflows/ci-subscription.yml @@ -53,7 +53,6 @@ jobs: name: Build & Push Docker runs-on: ubuntu-latest needs: lint-and-test - if: github.ref == 'refs/heads/main' permissions: contents: read packages: write @@ -62,6 +61,7 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 - name: Log in to GHCR + if: github.ref == 'refs/heads/main' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} @@ -79,7 +79,7 @@ jobs: uses: docker/build-push-action@v6 with: context: services/subscription - push: true + push: ${{ github.ref == 'refs/heads/main' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha diff --git a/CHANGELOG.md b/CHANGELOG.md index 455fed4..9d13bf0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,18 @@ Versions map to GitHub pull requests; the project does not use semver tags yet. --- +## [0.9.0] - 2026-03-24 - PR #10: Docker build validation on every PR + +### Fixed + +- All six `build-and-push` CI jobs were gated with + `if: github.ref == 'refs/heads/main'`, meaning a broken Dockerfile was only + discovered after merge. The job now runs on every push and PR; only the push + to GHCR remains conditional on `main`. The GHCR login step is also skipped + on PRs so no credentials are required for a build-only run. + +--- + ## [0.8.0] - 2026-03-23 - PR #8: Fix collector and analyzer Docker builds ### Fixed diff --git a/PROGRESS.md b/PROGRESS.md index 59ffb03..46cf1de 100644 --- a/PROGRESS.md +++ b/PROGRESS.md @@ -62,9 +62,8 @@ Kong proxies the public API. OTel Collector forwards traces to Jaeger. | CI - e2e | passing | push/PR on `e2e/**` | | PR Checks | passing | all PRs (commitlint + markdownlint) | -**Known gap:** Docker `build-and-push` only runs on `main`, not on PRs. -A failing Dockerfile is only caught after merge. Fix planned: build (no push) -on PRs too. +Docker `build-and-push` now runs on every PR (build only) and pushes to GHCR +only on `main`. A broken Dockerfile will fail the PR before merge. --- @@ -90,7 +89,7 @@ Items not yet started, ordered roughly by priority. ### Near-term -- [ ] Build (no push) Docker images on PRs so broken Dockerfiles are caught +- [x] Build (no push) Docker images on PRs so broken Dockerfiles are caught before merge. - [ ] Replace the `go get` workaround in Dockerfiles with properly committed `go.mod` / `go.sum` files (requires Go installed in the dev environment