Merge pull request nolabs-ai#523 from always-further/fix-image-bui

ci(workflows): extract push condition to environment variable

Author: lukehinds

.github/workflows/image-build.yml

@@ -38,6 +38,7 @@ permissions:
 
 env:
   CARGO_TERM_COLOR: always
+  PUSH_IMAGE: ${{ inputs.push || github.event.inputs.push == 'true' }}
 
 jobs:
   build-binaries:
@@ -146,7 +147,7 @@ jobs:
           fi
 
           TAGS="ghcr.io/always-further/nono:${VERSION}"
-          if [ "${{ inputs.push }}" = "true" ] && [ "$STABLE" = "true" ] && [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          if [ "${PUSH_IMAGE}" = "true" ] && [ "$STABLE" = "true" ] && [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             MAJOR_MINOR="${VERSION%.*}"
             TAGS="${TAGS},ghcr.io/always-further/nono:${MAJOR_MINOR}"
             TAGS="${TAGS},ghcr.io/always-further/nono:latest"
@@ -163,7 +164,7 @@ jobs:
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Log in to ghcr.io
-        if: ${{ inputs.push }}
+        if: ${{ env.PUSH_IMAGE == 'true' }}
         uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
@@ -177,19 +178,19 @@ jobs:
           context: docker-context
           file: docker-context/Dockerfile
           platforms: linux/amd64,linux/arm64
-          push: ${{ inputs.push }}
+          push: ${{ env.PUSH_IMAGE == 'true' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: |
             org.opencontainers.image.source=https://github.com/always-further/nono
             org.opencontainers.image.version=${{ steps.meta.outputs.version }}
             org.opencontainers.image.description=Capability-based sandboxing for untrusted AI agents
 
       - name: Install Cosign
-        if: ${{ inputs.push }}
+        if: ${{ env.PUSH_IMAGE == 'true' }}
         uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
 
       - name: Sign image with Cosign
-        if: ${{ inputs.push }}
+        if: ${{ env.PUSH_IMAGE == 'true' }}
         run: |
           cosign sign --yes \
             ghcr.io/always-further/nono@${{ steps.push.outputs.digest }}