feat(workflows): add docker-image CI gold-standard reusables (lint-compose, docker-image-ci)#251
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the reusable workflow permissions documentation by adding permissions for docker-image-ci.yml and adding lint-compose.yml to the list of workflows requiring contents: read. The reviewer noted that lint-container.yml and lint-compose.yml are already covered by the wildcard pattern lint-*.yml and suggested removing these redundant entries to simplify the table.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
…main The meta pins its leaf reusables @main; lint-compose.yml is introduced by netresearch/.github#251 and is not yet on main. GitHub resolves reusable uses: refs at startup, so an active lint-compose job makes the whole run startup-fail. Keep it off until the leaf is on main. Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
Reverts the diagnostic toggle. The run startup-fails either way until netresearch/.github#251 merges (the meta references lint-compose.yml@main, a leaf that only exists on the feature branch, and GitHub resolves reusable uses: refs at startup regardless of the job's if:). Keep the intended config; flip @feat/docker-gold-standard -> @main once #251 merges. Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
…mpose, docker-image-ci) Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
0ede9c9 to
f07ad73
Compare
|
Adds the docker-image archetype gold standard:
lint-compose.yml(leaf:docker compose configwith .env.example placeholder substitution) +docker-image-ci.yml(meta composing lint-container/lint-yaml/lint-markdown/lint-compose/build-container[push:false]/smoke-test-container/codeql/gitleaks/dependency-review). Caller union is 7 scopes (build-container statically declares packages/id-token/attestations:write). Local actionlint/yamllint/zizmor clean. Piloted against docker-ftp-server before merge.