Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 12 additions & 11 deletions .github/workflows/build-and-push.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -17,25 +17,26 @@ jobs:
with:
token: ${{ secrets.GH_PAT }}

- name: Login to ACR
uses: MapColonies/artifactory-login@v1.0.0
- name: Artifactory Login
uses: MapColonies/shared-workflows/actions/artifactory-login@artifactory-login-v1.0.0
with:
Comment on lines +21 to 22
Copy link

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This action is referenced by a movable tag. To reduce supply-chain risk, consider pinning to an immutable commit SHA (or another immutability mechanism your org uses) instead of a tag name.

Copilot uses AI. Check for mistakes.
registry: ${{ secrets.ACR_URL }}
username: ${{ secrets.ACR_PUSH_USER }}
password: ${{ secrets.ACR_PUSH_TOKEN }}
registry: acrarolibotnonprod.azurecr.io

- name: Build and Push Helm Chart
uses: MapColonies/build-and-push-helm@v1.0.1
uses: MapColonies/shared-workflows/actions/build-and-push-helm@build-and-push-helm-v1.0.1
with:
Comment on lines +28 to 29
Copy link

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This action is referenced by a movable tag. To reduce supply-chain risk, consider pinning to an immutable commit SHA (or another immutability mechanism your org uses) instead of a tag name.

Copilot uses AI. Check for mistakes.
context: ./helm
domain: raster
project: ${{ github.repository }}
tag: ${{ github.ref_name }}
registry_url: acrarolibotnonprod.azurecr.io
registry: ${{ secrets.ACR_URL }}

- name: Update Artifacts File
uses: MapColonies/update-artifacts-file@v1.1.1
- name: Update Artifacts File- Helm
uses: MapColonies/shared-workflows/actions/update-artifacts-file@update-artifacts-file-v1.1.1
with:
Comment on lines +35 to 36
Copy link

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This action is referenced by a movable tag. To reduce supply-chain risk, consider pinning to an immutable commit SHA (or another immutability mechanism your org uses) instead of a tag name.

Copilot uses AI. Check for mistakes.
domain: raster
project: ${{ github.repository }}
tag: ${{ github.ref_name }}
artifact_name: ${{ github.event.repository.name }}
artifact_tag: ${{ github.ref_name }}
type: helm
registry: ${{ secrets.ACR_URL }}
github_token: ${{ secrets.GH_PAT }}
Copy link

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

github_token is set to a PAT (secrets.GH_PAT). If the action only needs repo-scoped access, use GITHUB_TOKEN so access is constrained by the workflow permissions and can’t exceed what the job declares.

Suggested change
github_token: ${{ secrets.GH_PAT }}
github_token: ${{ github.token }}

Copilot uses AI. Check for mistakes.