Skip to content

Sync missing GHCR images - #48

Open
welteki wants to merge 1 commit into
inlets:masterfrom
welteki:sync-missing-images
Open

Sync missing GHCR images#48
welteki wants to merge 1 commit into
inlets:masterfrom
welteki:sync-missing-images

Add image sync workflow

6a95b36
Select commit
Loading
Failed to load commit list.
reviewfn / succeeded Jul 24, 2026 in 1m 28s

AI Code Review Results

AI Pull Request Overview

Disclaimer: This review was generated by automated AI and may contain errors. Do not trust its outputs without human verification.

Summary

  • Adds a scheduled and manually dispatched workflow to mirror missing GHCR image tags.
  • Adds a Bash helper that compares source and target tags with crane ls and copies missing tags with crane cp.
  • Handles an absent target package by treating NAME_UNKNOWN as an empty target tag list.
  • Writes copied tags and aggregate counts to the GitHub Actions step summary.
  • The main concern is supply-chain exposure from a mutable third-party action reference in a credentialed publishing workflow.

Approval rating (1-10)

7/10. The sync logic is focused, but the workflow should not grant package write credentials to an action fetched from a mutable branch.

Summary per file

Summary per file
File path Summary
.github/workflows/sync-images.yml Adds scheduled/manual GHCR sync workflow with package write permission.
hack/sync-images.sh Adds tag comparison and image copy helper using crane.

Overall Assessment

The implementation is small and the image comparison/copy flow is generally clear. The notable issue is in the workflow trust boundary: it logs in to GHCR with packages: write and then relies on an action pinned to a moving branch, which makes the publishing token available to code that can change outside this repository.

Detailed Review

Detailed Review

.github/workflows/sync-images.yml

Medium: Pin the third-party setup action instead of using @master

The workflow grants packages: write, logs in to GHCR, and then runs subsequent steps in the same job. alexellis/arkade-get@master is a mutable branch reference, so any future change to that branch can execute in this workflow context and affect the same runner environment used for package publishing.

This is higher risk than a read-only CI helper because the job's purpose is to publish images to ghcr.io/inlets/inlets-pro. Pin the action to an immutable commit SHA, or use another installation path where both the action and downloaded binary provenance are fixed.

Affected lines: .github/workflows/sync-images.yml:26-29

- name: Setup arkade
  uses: alexellis/arkade-get@<commit-sha>
  with:
    crane: v0.21.7

hack/sync-images.sh

No blocking findings.

AI agent details.

Agent processing time: 1m24.638s
Environment preparation time: 3.213s
Total time from webhook: 1m31.54s
View more details on reviewfn