Skip to content
Draft
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 58 additions & 0 deletions .github/workflows/build-server-ee-image-for-dev-tests.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
on:
workflow_dispatch:
inputs:
base-image-name:
type: string
description: "Server base image name"
required: true
default: 'aerospike/aerospike-server-enterprise'
base-image-tag:
type: string
description: "Server base image tag"
required: true
default: 'latest'
new-image-tag:
type: string
description: "New image tag"
required: true
default: 'latest'

env:
TLS_PORT: 4333
REGISTRY: ghcr.io

jobs:
build-image:
runs-on: ubuntu-24.04
steps:
- name: Log into Github's Docker registry to upload our custom server Docker image
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Set new Docker image name and tag
uses: docker/metadata-action@v5
id: meta
with:
images: ${{ env.REGISTRY }}/aerospike/aerospike-server-enterprise
flavor: |
latest=false
type=raw,value=${{ inputs.new-image-tag }}

- name: Build Aerospike server EE Docker image for testing
uses: docker/build-push-action@v6
with:
# Don't want to use default Git context or else it will clone the whole Python client repo again
context: .github/workflows/docker-build-context
build-args: |
SERVER_IMAGE=${{ inputs.base-image-name }}:${{ inputs.base-image-tag }}
TLS_PORT=${{ env.TLS_PORT }}
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
# setup-buildx-action configures Docker to use the docker-container build driver
# This driver doesn't publish an image locally by default
# so we have to manually enable it
load: true
push: true
Comment on lines +26 to +58

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 1 month ago

To fix the problem, an explicit permissions block should be added at either the workflow or job level to limit the GITHUB_TOKEN's permissions to only what is strictly needed. For this workflow, pushing Docker images to the GitHub Container Registry and accessing repository content are required. Thus, setting permissions to contents: read and packages: write suffices. The recommended best practice is to set permissions at the top level of the workflow unless specific jobs require broader or different permissions.

Change required:
Add the following at the root of .github/workflows/build-server-ee-image-for-dev-tests.yml, directly after the on: or env: keys (typically after on: and before env:):

permissions:
  contents: read
  packages: write

No additional imports, method definitions, or variable definitions are required.


Suggested changeset 1
.github/workflows/build-server-ee-image-for-dev-tests.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/build-server-ee-image-for-dev-tests.yml b/.github/workflows/build-server-ee-image-for-dev-tests.yml
--- a/.github/workflows/build-server-ee-image-for-dev-tests.yml
+++ b/.github/workflows/build-server-ee-image-for-dev-tests.yml
@@ -17,6 +17,10 @@
         required: true
         default: 'latest'
 
+permissions:
+  contents: read
+  packages: write
+
 env:
   TLS_PORT: 4333
   REGISTRY: ghcr.io
EOF
@@ -17,6 +17,10 @@
required: true
default: 'latest'

permissions:
contents: read
packages: write

env:
TLS_PORT: 4333
REGISTRY: ghcr.io
Copilot is powered by AI and may make mistakes. Always verify output.
Loading