[dati18]

Dependabot PR builds use a "read-only" GITHUB_TOKEN, so publishing the image to GHCR fails even though the Docker build succeeds.

• Grant the workflow contents: read and packages: write permission
• Continue building images for PRs without pushing them
• Keep publishing images on pushes to main.

Note: This PR is my a testing ground; no need to take it serious

[tarrow]

@dati18 sorry for being slow. Why do we need to tweak the permissions AND change the conditions that the workflow runs? Isn't the idea that if it's not pushing on the PR then the token it runs with will have less restrictions anyway?

[dati18]

@tarrow

• I set push: false for a pull_request event and true for other eevents. it tells Buildx not to upload the image but it can't reduce the token's permission
• permissions: packages: write requests package-write access for the workflow to publish on a push to main, but placed at workflow level, it also applies to PR runs where Github allows it.
• contents: read lets actions/checkout fetch Cradle’s source and allows the workflow’s Git reads; it grants no write access.

The permission change is not really needed, I added them to test

[outdooracorn]

I would like to keep publishing images on pull_requests if possible as it makes it easier to test PRs in minikube if there is an image in the GHCR to pull.

How about only trying to push the image for PRs that aren't created by dependabot?
E.g. see option 1 of these github docs: https://docs.github.com/en/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions#troubleshooting-failures-when-dependabot-triggers-existing-workflows