fix(do-7299): replace Docker image with composite+binary for ARM64 support - #1
Merged
Conversation
added 3 commits
August 18, 2026 17:12
…pport The upstream action uses 'docker://ghcr.io/mszostok/codeowners-validator:v0.7.2' which is a single-arch AMD64 image. v0.7.2 ships Linux arm64 binaries on GitHub Releases, so switch to a composite action that downloads the correct arch binary. Pinned to v0.7.2 to avoid the token scope regression introduced in v0.7.3+ (upstream issue #143).
Composite actions do not auto-set INPUT_* env vars the way Docker/JS actions do. codeowners-validator reads config via ENVS_PREFIX=INPUT, so each input must be explicitly exported with the INPUT_ prefix.
- codeql-analysis.yml: bump codeql-action v1 -> v3 (v1 incompatible with current runners) - pull-requests.yml: skip integration-test when TOKEN_INTEGRATION_TESTS secret absent (fork-safe) - hack/run-lint.sh: fix dead goreleaser.com linter install URL (see upstream PR #184) None of these affect action.yml behaviour — Go source is unchanged.
added 4 commits
August 19, 2026 09:37
Runs the composite action end-to-end on both ubuntu-latest (amd64) and runs-on/pool=small-arm64 (arm64) to confirm the binary download and execution works on both architectures. Uses 'checks: syntax,files' to avoid needing a GitHub token.
DriveWealth has org-level default CodeQL scanning — the upstream codeql-analysis.yml (which uses the deprecated codeql-action@v1) is redundant and fails on current runners.
bd16ells
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Replaces
using: docker(single-arch AMD64 ghcr.io image) withusing: compositethat downloads the correct arch binary from GitHub Releases, supporting bothx86_64andaarch64.Files changed
action.yml— core change: swap Docker image for composite + arch-aware binary downloadREADME.md— fork notice explaining this is a shim, not a true fork.github/CODEOWNERS— DriveWealth org requirement (* @DriveWealth/devops).github/workflows/test-action.yml— new: runs action end-to-end on bothubuntu-latest(amd64) andruns-on/pool=small-arm64(arm64) to confirm the binary works on both arches.github/workflows/pull-requests.yml— skipintegration-testwhenTOKEN_INTEGRATION_TESTSsecret absent (fork-safe).github/workflows/codeql-analysis.yml— bumpcodeql-action@v1→@v3(v1 incompatible with current runners)hack/run-lint.sh— fix deadinstall.goreleaser.comURL (see upstream PR #184)Why
The upstream
ghcr.io/mszostok/codeowners-validator:v0.7.2image is AMD64-only and fails on ARM64 runners. v0.7.2 ships aLinux_arm64binary on GitHub Releases — this shim uses that instead.Pinned to v0.7.2 (not latest) to avoid the GitHub App token scope regression introduced in v0.7.3+ (upstream issue mszostok/codeowners-validator#143).
Issue #174 (macOS
Killed: 9) does not apply — that is macOS Gatekeeper, our runners are Linux.Issue #183 (install.sh unsupported platform) does not apply — that is the install.sh script; we download the tarball directly.
How to use in dw-github-workflows
After merging, replace both references in
ci-validate-codeowners.yaml:Also remove the stale AMD64-only
runs-onpin and comment on thecodeownersjob inci-validate-codeowners.yamlanddwp-feature-branch.yaml.References
Checklist
action.ymlupdatedx86_64→x86_64,aarch64→arm64INPUT_*env vars set explicitly (composite actions don't auto-set them)