Change location of jsonnet image

[greenc-FNAL]

CI/CD

• Updated Jsonnet container image reference in GitHub Actions workflows from public.ecr.aws/bitnami/jsonnet:latest to docker.io/dysnix/jsonnet:latest
  • Modified in jsonnet-format-check.yaml
  • Modified in jsonnet-format-fix.yaml

[coderabbitai]

📝 Walkthrough

Walkthrough

Both GitHub Actions workflows for Jsonnet formatting are updated to pull the Jsonnet container image from docker.io/dysnix/jsonnet:latest instead of public.ecr.aws/bitnami/jsonnet:latest. The format-check and format-fix jobs maintain their existing configurations while using the new registry source.

Changes

Jsonnet tooling Docker image updates

Layer / File(s)	Summary
Docker image registry updates for Jsonnet workflows .github/workflows/jsonnet-format-check.yaml, .github/workflows/jsonnet-format-fix.yaml	Both the jsonnet-format-check and jsonnet-format-fix workflows switch their container image registry from public.ecr.aws/bitnami/jsonnet:latest to docker.io/dysnix/jsonnet:latest.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the primary change: migrating the jsonnet container image from AWS ECR to Docker Hub across both workflow files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch maintenance/jsonnet-image-move

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[aolivier23]

Thanks, looks good!

[greenc-FNAL]

✅ 7 CodeQL alerts resolved compared to main

• ✅ Warning # 182 actions/unpinned-tag at .github/actions/prepare-check-outputs/action.yaml:47:13 — Unpinned 3rd party Action 'action.yaml' step Uses Step: get_pr uses 'Framework-R-D/phlex/.github/actions/get-pr-info' with ref 'main', not a pinned commit hash
• ✅ Warning # 183 actions/unpinned-tag at .github/actions/prepare-check-outputs/action.yaml:51:13 — Unpinned 3rd party Action 'action.yaml' step Uses Step: detect_act uses 'Framework-R-D/phlex/.github/actions/detect-act-env' with ref 'main', not a pinned commit hash
• ✅ Warning # 184 actions/unpinned-tag at .github/actions/prepare-fix-outputs/action.yaml:29:13 — Unpinned 3rd party Action 'action.yaml' step Uses Step: get_pr uses 'Framework-R-D/phlex/.github/actions/get-pr-info' with ref 'main', not a pinned commit hash
• ✅ Warning # 185 actions/unpinned-tag at .github/actions/run-change-detection/action.yaml:62:13 — Unpinned 3rd party Action 'action.yaml' step Uses Step: filter uses 'Framework-R-D/phlex/.github/actions/detect-relevant-changes' with ref 'main', not a pinned commit hash
• ✅ Warning # 186 actions/unpinned-tag at .github/actions/workflow-setup/action.yaml:68:13 — Unpinned 3rd party Action 'action.yaml' step Uses Step: prepare_check uses 'Framework-R-D/phlex/.github/actions/prepare-check-outputs' with ref 'main', not a pinned commit hash
• ✅ Warning # 187 actions/unpinned-tag at .github/actions/workflow-setup/action.yaml:79:13 — Unpinned 3rd party Action 'action.yaml' step Uses Step: prepare_fix uses 'Framework-R-D/phlex/.github/actions/prepare-fix-outputs' with ref 'main', not a pinned commit hash
• ✅ Warning # 188 actions/unpinned-tag at .github/actions/workflow-setup/action.yaml:128:13 — Unpinned 3rd party Action 'action.yaml' step Uses Step: detect uses 'Framework-R-D/phlex/.github/actions/run-change-detection' with ref 'main', not a pinned commit hash

Review the full CodeQL report for details.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/jsonnet-format-check.yaml:
- Line 79: Replace the floating tag "docker.io/dysnix/jsonnet:latest" with an
immutable digest reference (docker.io/dysnix/jsonnet@sha256:<digest>) in both
workflow usages mentioned (the image field in jsonnet-format-check.yaml and the
docker run invocation in jsonnet-format-fix.yaml); obtain the correct sha256
digest for the exact image you want (e.g., via docker pull + docker inspect or
manifest inspect) and update both occurrences so they match exactly to ensure
reproducible CI.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5b729af3-5846-482c-a7b6-6ff539d034c1

📥 Commits

Reviewing files that changed from the base of the PR and between 4ed92fc and a94c84d.

📒 Files selected for processing (2)

• .github/workflows/jsonnet-format-check.yaml
• .github/workflows/jsonnet-format-fix.yaml

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: Analyze actions with CodeQL
• GitHub Check: scripts-test

🧰 Additional context used

🪛 zizmor (1.25.2)

.github/workflows/jsonnet-format-check.yaml

[error] 79-79: unpinned image references (unpinned-images): container image is pinned to latest

(unpinned-images)