Notes on image tags

Tagging in a production team is an artform

• Docker’s Metadata Action is awesome for auto-tagging and labels
• It’s removed many long shell scripts for teams with custom tagging
• Let’s dig into those tagging rules real quick

tags: |
  type=raw,value=latest,enable=${{ endsWith(github.ref, github.event.repository.default_branch) }}
  type=ref,event=pr
  type=ref,event=branch
  type=semver,pattern={{version}}

Add permissions to every workflow

• By default, Actions might have R/W to everything in repo
• This is set in Settings > Actions at repo or org level
• Let’s ensure we start with a "least privilege" mindset in wordsmith-web

1. Go to org Settings > Actions > General > Workflow Permissions
2. Ensure it’s set to Read repository contents and packages permissions
3. Manually add permissions needed to each workflow (next slide)
4. Permissions can be per workflow or per job (see all perms)