Sync missing GHCR images

[welteki]

Description

Adds a sync-images workflow that copies missing image tags from ghcr.io/openfaasltd/inlets-pro to ghcr.io/inlets/inlets-pro. It runs nightly and can also be started manually.

The workflow uses crane ls to compare source and target tags, skips tags already present in the public package, copies only missing tags with crane cp, and writes copied tags plus an aggregate skipped count to the workflow summary. The source package is expected to be public; the workflow uses the repository GITHUB_TOKEN with packages: write to publish to the public package.

Manual sync

Run the workflow from GitHub Actions and set tag to a version, for example 0.11.14. This copies ghcr.io/openfaasltd/inlets-pro:0.11.14 to ghcr.io/inlets/inlets-pro:0.11.14 if it is missing. If the tag is already present, it is skipped and included in the skipped count. Leave tag empty to sync all missing tags.

Motivation and context

This is part of a series of changes to automate release publishing from the private inlets-pro repo and syncing those releases to the public inlets-pro repo.

How has this been tested

• Dry-ran the sync logic locally with the public package as both source and target and an existing tag.
• Tested the workflow end-to-end in a separate organization by syncing a public test image tag to a new GHCR package and verifying that the copied target image digest matched the source image digest.

[derek]

Thank you for your contribution. unfortunately, one or more of your commits are missing the required "Signed-off-by:" statement. Signing off is part of the Developer Certificate of Origin (DCO) which is used by this project.

Read the DCO and project contributing guide carefully, and amend your commits using the git CLI. Note that this does not require any cryptography, keys or special steps to be taken.

💡 Shall we fix this?

This will only take a few moments.

First, clone your fork and checkout this branch using the git CLI.

Next, set up your real name and email address:

git config --global user.name "Your Full Name"
git config --global user.email "you@domain.com"

Finally, run one of these commands to add the "Signed-off-by" line to your commits.

If you only have one commit so far then run: git commit --amend --signoff and then git push --force.
If you have multiple commits, watch this video.

Check that the message has been added properly by running "git log".

[reviewfn]

AI Pull Request Overview

Disclaimer: This review was generated by automated AI and may contain errors. Do not trust its outputs without human verification.

Summary

• Adds a scheduled and manually dispatched workflow to mirror missing GHCR image tags.
• Adds a Bash helper that compares source and target tags with crane ls and copies missing tags with crane cp.
• Handles an absent target package by treating NAME_UNKNOWN as an empty target tag list.
• Writes copied tags and aggregate counts to the GitHub Actions step summary.
• The main concern is supply-chain exposure from a mutable third-party action reference in a credentialed publishing workflow.

Approval rating (1-10)

7/10. The sync logic is focused, but the workflow should not grant package write credentials to an action fetched from a mutable branch.

Summary per file

Summary per file

File path	Summary
.github/workflows/sync-images.yml	Adds scheduled/manual GHCR sync workflow with package write permission.
hack/sync-images.sh	Adds tag comparison and image copy helper using crane.

Overall Assessment

The implementation is small and the image comparison/copy flow is generally clear. The notable issue is in the workflow trust boundary: it logs in to GHCR with packages: write and then relies on an action pinned to a moving branch, which makes the publishing token available to code that can change outside this repository.

Detailed Review

Detailed Review

.github/workflows/sync-images.yml

Medium: Pin the third-party setup action instead of using @master

The workflow grants packages: write, logs in to GHCR, and then runs subsequent steps in the same job. alexellis/arkade-get@master is a mutable branch reference, so any future change to that branch can execute in this workflow context and affect the same runner environment used for package publishing.

This is higher risk than a read-only CI helper because the job's purpose is to publish images to ghcr.io/inlets/inlets-pro. Pin the action to an immutable commit SHA, or use another installation path where both the action and downloaded binary provenance are fixed.

Affected lines: .github/workflows/sync-images.yml:26-29

- name: Setup arkade
  uses: alexellis/arkade-get@<commit-sha>
  with:
    crane: v0.21.7

hack/sync-images.sh

No blocking findings.

AI agent details.

Agent processing time: 1m24.638s
Environment preparation time: 3.213s
Total time from webhook: 1m31.54s

[welteki]

Medium: Pin the third-party setup action instead of using @master

We follow the same pattern for the arkade-get action in all our workflows, pinning to @master. The arkade-get action is also owned by us which minimises the risk.