Skip to content

Update Docker actions to use tags instead hashes #42621

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
szabgab wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update Docker actions to use tags instead hashes #42621

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions content/actions/tutorials/publish-packages/publish-docker-images.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,29 +196,29 @@ jobs:
uses: {% data reusables.actions.action-checkout %}

- name: Log in to Docker Hub
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
uses: docker/login-action@v3
with:
username: {% raw %}${{ secrets.DOCKER_USERNAME }}{% endraw %}
password: {% raw %}${{ secrets.DOCKER_PASSWORD }}{% endraw %}

- name: Log in to the Container registry
uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
uses: docker/login-action@v3
with:
registry: {% ifversion fpt or ghec %}ghcr.io{% elsif ghes %}{% data reusables.package_registry.container-registry-hostname %}{% endif %}
username: {% raw %}${{ github.actor }}{% endraw %}
password: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}

- name: Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
uses: docker/metadata-action@v5
Copy link

Copilot AI Jan 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow examples in this file include a reusable comment stating "GitHub recommends pinning actions to a commit SHA" (via the actions-use-sha-pinning-comment reusable). This directly contradicts the changes being made in this PR, which replace commit SHA pins with version tags.

According to the security documentation at content/actions/reference/security/secure-use.md lines 138-160, pinning to a full-length commit SHA is the most secure option and is recommended for third-party actions. The PR description states that tags are recommended "by other parts of the GitHub documentation," but this appears to conflict with the security best practices documented in the codebase.

If the intent is to use tags instead of SHAs in these examples (perhaps for simplicity or readability in tutorial content), the reusable comment should be removed from these workflow examples to avoid giving contradictory guidance to users.

Copilot uses AI. Check for mistakes.
with:
images: |
my-docker-hub-namespace/my-docker-hub-repository
{% data reusables.package_registry.container-registry-hostname %}/{% raw %}${{ github.repository }}{% endraw %}
- name: Build and push Docker images
id: push
uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
uses: docker/build-push-action@v6
Comment on lines +199 to +221
Copy link

Copilot AI Jan 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changes in this PR only update the third example workflow (lines 199-221) to use version tags, but the first example workflow in this file (lines 97, 104, 110) still uses SHA commit hashes for the same Docker actions. This creates an inconsistency within the same documentation file.

For consistency with the changes being made here, the first example should also be updated from:

Additionally, both examples include a reusable comment stating "GitHub recommends pinning actions to a commit SHA" which directly contradicts the purpose of this PR. If the recommendation has changed to use tags instead of SHAs, this reusable comment should be updated or removed from these examples.

Copilot uses AI. Check for mistakes.
with:
context: .
push: true
Expand Down
Loading