Repository navigation
ci(docker): stop uploading workflow artifacts from image builds - #39
Merged
Merged
Conversation
Private repositories pay for artifact storage out of the org's Actions budget. Once it is spent, every upload fails: game-survivalgames run 39265980480 pushed its image and then went red in "Generate SBOM", whose anchore/sbom-action uploads the SPDX file as an artifact by default. - docker-gradle-build-push: drop the anchore SBOM scan and the sbom-* upload. The push build now attaches an SPDX SBOM attestation to the image in GHCR (`sbom: true`), next to the provenance attestation it already had. Nothing downloaded the sbom-* artifacts. - docker-gradle-build-push, platform-test-preview: set DOCKER_BUILD_RECORD_UPLOAD=false so build-push-action no longer uploads the .dockerbuild record. The build summary stays. - Contract tests: assert no artifact uploads, and bring the runner assertions up to date with the RunsOn routing from #37, which left the contract job failing on main.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Private repositories pay for artifact storage out of the org's Actions budget. Once it is spent, every upload fails with
Failed to CreateArtifact: Artifact storage quota has been hit. game-survivalgames run 39265980480 pushed its image and then went red in Generate SBOM: anchore/sbom-action uploads the SPDX file as an artifact by default (upload-artifact: true). The build record upload from build-push-action failed in the same run too, only as a warning.Live artifacts in private repos before this change: ~960
.dockerbuildbuild records (~63 MiB) and ~130 MiB of SBOMs (sbom-*plus anchore'sgroundsgg-<repo>_<tag>.spdx.json).What
sbom-*upload. The push build setssbom: true, so BuildKit attaches an SPDX SBOM attestation to the image in GHCR, next to the provenance attestation the images already carry (the index already has an attestation manifest, so the media type does not change). Read it withdocker buildx imagetools inspect ghcr.io/groundsgg/<repo>:edge --format '{{ json .SBOM }}'. The PR build (load: true) is unchanged.DOCKER_BUILD_RECORD_UPLOAD: falseon the job. The build summary stays.grounds-runnersfrom before ci: run private repos on RunsOn instead of hbr1 #37, so the contract job has been failing on main since then. They now check the RunsOn label.Consumers checked
Nothing in the org downloads
sbom-*, the anchore.spdx.jsonartifacts or the build records. The onlydownload-artifactusers are grounds-vanilla's release (its own compliance artifacts), resourcepacks and publish-openapi-snapshot, none of which are touched here.All callers use
@main, so merging this fixes every repo on the shared workflow (15 private ones currently hold artifacts) without per-repo changes.