From 7b05a648540b430bf589deb18e6ee272cab07180 Mon Sep 17 00:00:00 2001 From: Luca Ghersi Date: Mon, 14 Sep 2026 18:43:19 +0200 Subject: [PATCH] feat(gitops): allow a different image path in the GitOps commit Some registries separate where an image is pushed from where it is pulled. Google Artifact Registry is one: a push is accepted only into a standard repository, while a deployment should reference the virtual repository in front of it, so the upstream behind it can change without editing every manifest. gitops-docker-image writes that path to the GitOps repository. It defaults to docker-image, so an unset input leaves the commit byte for byte what it was. Only the GitOps commit is affected. The build, the push and the release retag keep using docker-image, because they act on the repository that stores the image. The scripts are untouched: update-gitops.sh already takes its image from the environment, so the choice is made where the step is wired. Co-Authored-By: Claude Opus 5 (1M context) --- README.md | 23 +++++++++++++++++++++++ action.yml | 5 ++++- 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 033414d..0452f5d 100644 --- a/README.md +++ b/README.md @@ -106,6 +106,28 @@ jobs: clusters/customization/prod/mothership/my-service/my-service-helm.yaml spec.template.spec.containers.redbook.image ``` +### Publishing and consuming from different paths + +Some registries separate where an image is pushed from where it is pulled. Google Artifact Registry +is one: a push is accepted only into a standard repository, while deployments should reference the +virtual repository in front of it, so the upstream behind it can change without editing every +manifest. + +`gitops-docker-image` writes a different path to the GitOps repository than the one built and +pushed: + +```yaml + with: + docker-registry: europe-docker.pkg.dev + docker-image: my-project/images-publish/my-service + gitops-docker-image: my-project/images/my-service +``` + +It defaults to `docker-image`, so leaving it unset keeps both paths the same. + +Only the GitOps commit is affected. The build, the push and the release retag all use +`docker-image`, because they act on the repository that actually stores the image. + ### Deployment tracking annotations By default (`deployment-annotations: 'true'`), whenever the action updates a GitOps file it stamps the following annotations onto the manifest's `metadata.annotations`: @@ -226,6 +248,7 @@ Pass the same `docker-*` inputs to both jobs — the merge job recomputes the ta | `gitops-user` | GitHub User for GitOps | `Staffbot` | | `gitops-email` | GitHub Email for GitOps | `staffbot@staffbase.com` | | `gitops-token` | GitHub Token for GitOps | | +| `gitops-docker-image` | Image path written to the GitOps repository, when it differs from the one pushed to. See [Publishing and consuming from different paths](#publishing-and-consuming-from-different-paths) | `docker-image` | | `gitops-dev` | Files which should be updated by the GitHub Action for DEV, must be relative to the root of the GitOps repository | | | `gitops-stage` | Files which should be updated by the GitHub Action for STAGE, must be relative to the root of the GitOps repository | | | `gitops-prod` | Files which should be updated by the GitHub Action for PROD, must be relative to the root of the GitOps repository | | diff --git a/action.yml b/action.yml index 7449fa8..b18fe69 100644 --- a/action.yml +++ b/action.yml @@ -105,6 +105,9 @@ inputs: gitops-token: description: 'GitHub Token for GitOps' required: false + gitops-docker-image: + description: 'Image path written to the GitOps repository, when it differs from the one pushed to. Registries that separate publishing from consumption need this: Google Artifact Registry accepts a push only into a standard repository, while deployments should reference the virtual repository in front of it. Defaults to docker-image, which is the same path.' + required: false gitops-dev: description: 'Files which should be updated by the GitHub Action for DEV' required: false @@ -283,7 +286,7 @@ runs: shell: bash env: INPUT_DOCKER_REGISTRY: ${{ inputs.docker-registry }} - INPUT_DOCKER_IMAGE: ${{ inputs.docker-image }} + INPUT_DOCKER_IMAGE: ${{ inputs.gitops-docker-image || inputs.docker-image }} INPUT_TAG: ${{ steps.preparation.outputs.gitops_tag }} INPUT_PUSH: ${{ steps.preparation.outputs.push }} INPUT_GITOPS_USER: ${{ inputs.gitops-user }}