Add DRY_RUN for PR-based runs

Author: lzap

.github/workflows/fedora-centos.yml

@@ -14,6 +14,7 @@ permissions:
   packages: write
 
 env:
+  DRY_RUN: ${{ github.event_name == 'pull_request' && '1' || '' }}
   CACHE_URL: ghcr.io/${{ github.repository }}/cache
 
 jobs:

.github/workflows/rhel.yml

@@ -12,6 +12,7 @@ permissions:
   packages: write
 
 env:
+  DRY_RUN: ${{ github.event_name == 'pull_request' && '1' || '' }}
   FOUNDRY_IMAGE: ghcr.io/${{ github.repository }}/foundry:${{ github.ref == 'refs/heads/main' && 'latest' || github.sha }}
   FOUNDRY_IMAGE_HEAD: ghcr.io/${{ github.repository }}/foundry:latest
   # private cache registry
@@ -49,6 +50,7 @@ jobs:
             -f Containerfile.foundry \
             -t "${{ env.FOUNDRY_IMAGE }}" .
 
+      # Always push foundry image so run-matrix can pull it; DRY_RUN only skips push inside the container (build-and-push.sh / generate-manifests.sh)
       - name: Push foundry image
         run: |
           podman push "${{ env.FOUNDRY_IMAGE }}"
@@ -111,5 +113,6 @@ jobs:
             -e "RHSM_USERNAME=$RHSM_USERNAME" -e "RHSM_PASSWORD=$RHSM_PASSWORD" \
             -e "CACHE_URL=$CACHE_URL" -e "CACHE_USERNAME=$CACHE_USERNAME" -e "CACHE_PASSWORD=$CACHE_PASSWORD" \
             -e "STORAGE_DRIVER=$STORAGE_DRIVER" -e "STORAGE_OPTS=$STORAGE_OPTS" -e "BUILDAH_ISOLATION=$BUILDAH_ISOLATION" \
+            -e "DRY_RUN=$DRY_RUN" \
             "${{ env.FOUNDRY_IMAGE }}" \
             ${{ matrix.script }} "$IMAGE"

.yamllint.yaml

@@ -2,7 +2,7 @@
 extends: default
 rules:
   line-length:
-    max: 140
+    max: 160
   document-start: disable
   truthy:
     check-keys: false

build-and-push.sh

@@ -5,6 +5,7 @@ set -euo pipefail
 #   REPO_USERNAME, REPO_PASSWORD  - optional; quay.io login (if missing, skips all push)
 #   CACHE_URL, CACHE_USERNAME, CACHE_PASSWORD - optional; all three required for any cache use
 #   TO_IMAGE, TO_TAG, ARCH, CONTAINERFILE, FROM_IMAGE, FROM_TAG - build params
+#   DRY_RUN - when set, skip all push operations (e.g. set for PR builds)
 
 if [ -n "${REPO_USERNAME:-}" ] && [ -n "${REPO_PASSWORD:-}" ]; then
   echo "$REPO_PASSWORD" | buildah login -u "$REPO_USERNAME" --password-stdin quay.io
@@ -37,12 +38,14 @@ buildah build --layers --arch="$ARCH" \
   -f "Containerfile.${CONTAINERFILE}" \
   -t "$IMAGE" .
 
-if [ -n "${REPO_USERNAME:-}" ] && [ -n "${REPO_PASSWORD:-}" ]; then
+if [ -z "${DRY_RUN:-}" ] && [ -n "${REPO_USERNAME:-}" ] && [ -n "${REPO_PASSWORD:-}" ]; then
   buildah push "$IMAGE"
 else
-  echo "Push skipped: REPO_USERNAME or REPO_PASSWORD missing"
+  echo "Push skipped: DRY_RUN is set or REPO_USERNAME or REPO_PASSWORD missing"
 fi
 
-if [ -n "${USE_CACHE:-}" ]; then
+if [ -z "${DRY_RUN:-}" ] && [ -n "${USE_CACHE:-}" ]; then
   buildah push "$IMAGE" "$CACHE_IMAGE"
+elif [ -n "${DRY_RUN:-}" ] && [ -n "${USE_CACHE:-}" ]; then
+  echo "Push skipped: DRY_RUN is set or REPO_USERNAME or REPO_PASSWORD missing"
 fi

generate-manifests.sh

@@ -5,6 +5,7 @@ set -euo pipefail
 #   REPO_USERNAME, REPO_PASSWORD  - quay.io login (optional; no push if missing)
 #   CACHE_URL, CACHE_USERNAME, CACHE_PASSWORD - optional; all three required for cache pull
 #   IMAGE, TAG, ARCHES - manifest params (ARCHES is space-separated)
+#   DRY_RUN - when set, skip manifest push (e.g. set for PR builds)
 
 if [ -n "${REPO_USERNAME:-}" ] && [ -n "${REPO_PASSWORD:-}" ]; then
   echo "$REPO_PASSWORD" | buildah login -u "$REPO_USERNAME" --password-stdin quay.io
@@ -43,8 +44,8 @@ for arch in $ARCHES; do
 done
 
 echo "Pushing manifest to $IMAGE:$TAG"
-if [ -n "${REPO_USERNAME:-}" ] && [ -n "${REPO_PASSWORD:-}" ]; then
+if [ -z "${DRY_RUN:-}" ] && [ -n "${REPO_USERNAME:-}" ] && [ -n "${REPO_PASSWORD:-}" ]; then
   buildah manifest push --all "$IMAGE:$TAG" "docker://$IMAGE:$TAG"
 else
-  echo "Push skipped: REPO_USERNAME or REPO_PASSWORD missing"
+  echo "Push skipped: DRY_RUN is set or REPO_USERNAME or REPO_PASSWORD missing"
 fi