chore(deps): update docker/build-push-action action to v7#7
chore(deps): update docker/build-push-action action to v7#7thekoma merged 1 commit intomainthekoma/agentmemory-image:mainfrom renovate/docker-build-push-action-7.xthekoma/agentmemory-image:renovate/docker-build-push-action-7.xCopy head branch name to clipboard
Conversation
📝 WalkthroughWalkthroughThe GitHub Actions workflow step in ChangesWorkflow Action Upgrade
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~1 minute Possibly related issues
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build.yml:
- Line 52: Replace the unpinned GitHub Action usage
`docker/build-push-action@v7` with the commit-pinned SHA
`docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf` (keeping the
v7 meaning) to satisfy the blanket policy; update the occurrence of
`docker/build-push-action@v7` in the workflow and, if the policy requires,
similarly pin other `@v*` actions in this file (verify runner `ubuntu-latest`
already meets any version requirements like v2.327.1+ for build-push-action).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 68942b29-e72c-4346-a56c-5a1454d0703e
📒 Files selected for processing (1)
.github/workflows/build.yml
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - uses: docker/build-push-action@v6 | ||
| - uses: docker/build-push-action@v7 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Fetch the commit SHA for the v7 tag of docker/build-push-action
gh api repos/docker/build-push-action/git/ref/tags/v7 --jq '.object.sha' 2>/dev/null || \
gh api repos/docker/build-push-action/tags --jq '.[] | select(.name == "v7") | .commit.sha'Repository: thekoma/agentmemory-image
Length of output: 110
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show relevant portion of the workflow around the updated action
sed -n '1,120p' .github/workflows/build.yml | nl -ba | sed -n '15,80p'Repository: thekoma/agentmemory-image
Length of output: 112
🌐 Web query:
docker/build-push-action v7 requires GitHub Actions runner v2.327.1+ ubuntu-latest hosted runner version
💡 Result:
Yes, docker/build-push-action v7 does require GitHub Actions runner v2.327.1 or later [1][2][3]. This requirement is primarily due to the action's transition to using Node 24 as its default runtime [1][4][5]. Because the GitHub Actions runner environment must support the runtime version used by the action, the runner must be version 2.327.1 or higher [1][3]. For users of GitHub-hosted runners (such as ubuntu-latest), these are automatically kept up-to-date and will satisfy this requirement. If you are using self-hosted runners, you must ensure that your runner software is updated to at least v2.327.1 to successfully execute the action [6][7]. Additionally, note that as of March 16, 2026, all self-hosted runners are required to be at least v2.329.0 for configuration and registration, which exceeds this minimum requirement [8].
Citations:
- 1: https://github.com/docker/build-push-action/releases/tag/v7.0.0
- 2: chore(deps): update docker/build-push-action action to v7 k8gb-io/k8gb#2288
- 3: Bump docker/build-push-action from 6 to 7 senzing-factory/github-action-docker-buildx-build#67
- 4: node 24 as default runtime docker/build-push-action#1470
- 5: Update docker/build-push-action action to v7 quipper/actions-runner#1057
- 6: https://github.com/actions/runner/releases/tag/v2.327.1
- 7: https://github.com/actions/runner/releases
- 8: https://github.blog/changelog/2026-02-05-github-actions-self-hosted-runner-minimum-version-enforcement-extended/
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Print workflow lines with numbers (cat -n is expected to exist)
cat -n .github/workflows/build.yml | sed -n '30,80p'Repository: thekoma/agentmemory-image
Length of output: 2253
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n "runs-on:" .github/workflows/build.ymlRepository: thekoma/agentmemory-image
Length of output: 99
Pin docker/build-push-action to a commit SHA (line 52)
Static analysis flags the action as unpinned per the blanket policy. Replace:
- uses: docker/build-push-action@v7
with:- uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf# v7
ubuntu-latest should already satisfy the v2.327.1+ runner requirement for build-push-action@v7. If the blanket policy applies to all actions, pin the other @v* actions in this workflow too.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 52-52: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build.yml at line 52, Replace the unpinned GitHub Action
usage `docker/build-push-action@v7` with the commit-pinned SHA
`docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf` (keeping the
v7 meaning) to satisfy the blanket policy; update the occurrence of
`docker/build-push-action@v7` in the workflow and, if the policy requires,
similarly pin other `@v*` actions in this file (verify runner `ubuntu-latest`
already meets any version requirements like v2.327.1+ for build-push-action).
Source: Linters/SAST tools
This PR contains the following updates:
v6→v7Release Notes
docker/build-push-action (docker/build-push-action)
v7.2.0Compare Source
v7.1.0Compare Source
Full Changelog: docker/build-push-action@v7.0.0...v7.1.0
v7.0.0Compare Source
DOCKER_BUILD_NO_SUMMARYandDOCKER_BUILD_EXPORT_RETENTION_DAYSenvs by @crazy-max in #1473Full Changelog: docker/build-push-action@v6.19.2...v7.0.0
v7Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.