From ef6d0834165050ecfd86f222d13f93d19892fcd3 Mon Sep 17 00:00:00 2001 From: Louis Parkin Date: Wed, 5 Aug 2026 15:53:03 +0200 Subject: [PATCH] STAC-25543: publish per-commit images for same-repo pull requests GitLab published a per-commit image on every branch and merge request, which is what made the manual beest verification button useful before merge. The GitHub lane gated publish-image and merge-multiarch-manifest on master, so no image existed for a commit until after it had already merged. Allow same-repository pull requests to publish as well. Fork PRs stay excluded by an explicit head-repo check, and GitHub does not expose QUAY_PASSWORD to them regardless. No push trigger is added for other branches: that would run every pipeline twice on a public repo. The tag is already correct pre-merge, since every job checks out github.event.pull_request.head.sha and derives the 8-char short SHA that beest resolves a branch to. push-single-arch refuses to overwrite an existing tag, but the repository merges via merge commits, so a master SHA never collides with the PR head SHA it came from. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ci.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index de1f801e..f45ea70a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -202,8 +202,10 @@ jobs: name: Publish and sign commit image (${{ matrix.arch }}) needs: image-smoke-and-scan if: >- - github.ref == 'refs/heads/master' && - (github.event_name == 'push' || github.event_name == 'workflow_dispatch') + (github.event_name == 'pull_request' && + github.event.pull_request.head.repo.full_name == github.repository) || + ((github.event_name == 'push' || github.event_name == 'workflow_dispatch') && + github.ref == 'refs/heads/master') runs-on: ${{ matrix.runner }} permissions: contents: read @@ -279,8 +281,10 @@ jobs: name: Publish and sign multi-architecture commit image needs: publish-image if: >- - github.ref == 'refs/heads/master' && - (github.event_name == 'push' || github.event_name == 'workflow_dispatch') + (github.event_name == 'pull_request' && + github.event.pull_request.head.repo.full_name == github.repository) || + ((github.event_name == 'push' || github.event_name == 'workflow_dispatch') && + github.ref == 'refs/heads/master') runs-on: ubuntu-24.04 permissions: contents: read