PR Custody

Gate latest promotion of self-hosted images to production ref

@kaavee315checks n/achecks…codex/propose-fix-for-image-promotion-vulnerability → master1 files · +1 −1review: @acsrujanreview: @abir-taheerreview: @anshugarg15updated 1w ago

GitHub

▸Description · 1 noise

Motivation

Prevent manually dispatched workflow runs on non-production refs from promoting built images to :latest, which could allow unreviewed or malicious images to be published.

Description

Update the PUBLISH_AS_LATEST environment expression in .github/workflows/self_hosted_image.yml to require github.ref_name == 'production' in addition to the existing push or workflow_dispatch && inputs.publish_as_latest == true condition.

Testing

Ran a Python validation to assert the new expression is present with python - <<'PY' ... PY and it succeeded.
Ran git diff --check to ensure no diff/whitespace issues and it succeeded.

Codex Task

▸ 1 bot/status comment hidden

@github-actions[bot]1w ago

🔍 Suggested Reviewers

Based on git blame analysis of 1 file(s):

Contributor	Contribution	Files
Srujan	44%	1
Utkarsh Dixit	15%	1
Rahul Lingala	9%	1
Rohan Prabhu	8%	1
Dhawal Upadhyay	6%	1

💡 Recommendation

Based on git history, Srujan or Utkarsh Dixit would be good reviewer(s) for this PR.

🤖 Based on git blame with recency weighting (recent edits count more).

loading diff…