update GHA to securely build and push docker images for third party PRs

Author: jabelone

.github/workflows/build_docker.pr.yml

@@ -13,40 +13,28 @@ jobs:
     outputs:
       branch: ${{ steps.extract_branch.outputs.branch }}
     steps:
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
-      - name: Login to DockerHub
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        uses: docker/setup-buildx-action@v3
       - name: Extract branch name
         shell: bash
         run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" | tr / - >> $GITHUB_OUTPUT
         id: extract_branch
-      - name: Build and push pr image
+      - name: Save PR number and branch name
+        run: |
+          mkdir -p ./pr
+          echo ${{ github.event.number }} > ./pr/prnumber
+          echo ${{ steps.extract_branch.outputs.branch }} > ./pr/branchname
+          echo membermatters/membermatters:untrusted-pr-${{ steps.extract_branch.outputs.branch }} > ./pr/imagename
+      - name: Build pr image
         id: docker_build
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v6
         with:
+          tags: membermatters/membermatters:untrusted-pr-${{ steps.extract_branch.outputs.branch }}
+          outputs: type=docker,dest=./pr/untrusted-pr-image.tar
           file: docker/Dockerfile
           platforms: linux/amd64
-          push: true
-          tags: membermatters/membermatters:untrusted-pr-${{ steps.extract_branch.outputs.branch }}
-    
-  comment_docker_image:
-    needs: build-docker-pr
-    runs-on: ubuntu-latest
-    steps:
-      - name: Comment name of docker image
-        id: comment_docker_image
-        uses: actions/github-script@v6
+      - name: Upload pr image as artifact
+        uses: actions/upload-artifact@v4
         with:
-          script: |
-            github.rest.issues.createComment({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              body: 'Created image with name `membermatters/membermatters:untrusted-pr-${{ needs.build-docker-pr.outputs.branch }}`.'
-            })
+          name: pr
+          path: ./pr/

.github/workflows/upload_docker.pr.yml

@@ -0,0 +1,86 @@
+name: Upload Docker Image (On PR - after build)
+
+on:
+  workflow_run:
+    workflows: ["Receive PR"]
+    types:
+      - completed
+
+jobs:
+  upload-docker-pr:
+    runs-on: ubuntu-latest
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    outputs:
+      imagename: ${{ steps.extract_image.outputs.imagename }}
+    steps:
+      - name: Download PR Image
+        uses: actions/[email protected]
+        with:
+          script: |
+            var artifacts = await github.actions.listWorkflowRunArtifacts({
+               owner: context.repo.owner,
+               repo: context.repo.repo,
+               run_id: ${{github.event.workflow_run.id }},
+            });
+            var matchArtifact = artifacts.data.artifacts.filter((artifact) => {
+              return artifact.name == "pr"
+            })[0];
+            var download = await github.actions.downloadArtifact({
+               owner: context.repo.owner,
+               repo: context.repo.repo,
+               artifact_id: matchArtifact.id,
+               archive_format: 'zip',
+            });
+            var fs = require('fs');
+            fs.writeFileSync('${{github.workspace}}/pr.zip', Buffer.from(download.data));
+      - run: ls -hal
+      - name: Unzip PR Image
+        run: |
+          unzip pr.zip
+      - run: ls -hal
+      - name: Check PR Metadata
+        run: |
+          cat ./pr/prnumber
+          cat ./pr/branchname
+          cat ./pr/imagename
+      - name: Extract image name
+        shell: bash
+        run: echo "imagename="$(cat test)"" | tr / - >> $GITHUB_OUTPUT
+        id: extract_image
+      - name: Load PR Image
+        run: |
+          docker load --input ./pr/untrusted-pr-image.tar
+          docker image ls -a
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to DockerHub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Build and Push
+        id: docker_build
+        uses: docker/build-push-action@v6
+        with:
+          file: docker/Dockerfile
+          push: true
+          tags: ${{ steps.extract_image.outputs.imagename }}
+
+  comment_docker_image:
+    needs: upload-docker-pr
+    runs-on: ubuntu-latest
+    steps:
+      - name: Comment name of docker image
+        id: comment_docker_image
+        uses: actions/github-script@v6
+        with:
+          script: |
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: 'Created image with name `${{ needs.upload-docker-pr.outputs.imagename }}`.'
+            })