ci: skip registry login and push on pull_request events

.github/workflows/build-base.yml

@@ -30,30 +30,43 @@ jobs:
     runs-on: ubuntu-latest
     env:
       HTTP_CLI_VERSION: v1.1.0
+      # Push to GHCR only on pushes to branches, never on pull_request events.
+      # Pull requests (especially Dependabot's) cannot read the repo secrets
+      # needed to authenticate, so they build for validation only.
+      PUSH: ${{ github.event_name != 'pull_request' }}
     steps:
       - uses: actions/checkout@v4
-      
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-        
+
       - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GHCR_PAT }}
-          
+
       - name: Build and push base
         run: |
-          echo "${{ secrets.GHCR_PAT }}" > github_token
+          if [ "${{ env.PUSH }}" = "true" ]; then
+            echo "${{ secrets.GHCR_PAT }}" > github_token
+            OUTPUT_FLAG="--push"
+          else
+            # No secrets available on PRs; provide a dummy secret file so the
+            # --secret mount resolves, and build without pushing.
+            echo "" > github_token
+            OUTPUT_FLAG="--output=type=cacheonly"
+          fi
           docker buildx build \
             --platform linux/arm64 \
             --provenance=false \
             --secret id=github_token,src=github_token \
             --build-arg HTTP_CLI_VERSION=${{ env.HTTP_CLI_VERSION }} \
             --target base \
             --tag ghcr.io/${{ github.repository_owner }}/lambda-shell-runtime:base \
-            --push \
+            $OUTPUT_FLAG \
             .
         env:
-          GITHUB_TOKEN: ${{ secrets.GHCR_PAT }}
+          GITHUB_TOKEN: ${{ secrets.GHCR_PAT }}

.github/workflows/build-installers.yml

@@ -20,27 +20,36 @@ jobs:
     runs-on: ubuntu-latest
     env:
       HTTP_CLI_VERSION: v1.1.0
+      # Push to registries only on pushes to branches, never on pull_request
+      # events. Pull requests (especially Dependabot's) cannot read the repo
+      # secrets needed to authenticate, so they build for validation only.
+      PUSH: ${{ github.event_name != 'pull_request' }}
     steps:
       - uses: actions/checkout@v4
-      
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-        
+
       - name: Configure AWS credentials
+        if: github.event_name != 'pull_request'
         uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: us-east-1
+
       - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GHCR_PAT }}
+
       - name: Log in to Public ECR
+        if: github.event_name != 'pull_request'
         run: aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
-          
+
       - name: Build and push installers
         run: |
           # Build awscurl-installer
@@ -50,7 +59,7 @@ jobs:
             --target awscurl-installer \
             --tag ghcr.io/${{ github.repository_owner }}/lambda-shell-runtime:awscurl-installer \
             --tag public.ecr.aws/l9f6r9f5/lambda-shell-runtime:awscurl-installer \
-            --push \
+            --${{ env.PUSH == 'true' && 'push' || 'output=type=cacheonly' }} \
             -f - . << 'EOF'
           FROM public.ecr.aws/lambda/provided:al2023 AS awscurl-installer
           RUN dnf install -y unzip python3-pip findutils && dnf clean all
@@ -59,16 +68,16 @@ jobs:
               find /tmp/awscurl -type f -name '*.pyc' -delete && \
               find /tmp/awscurl -type d -name '*.dist-info' -exec rm -rf {} +
           EOF
-          
+
           # Build awscli-installer
           docker buildx build \
             --platform linux/arm64 \
             --provenance=false \
             --target awscli-installer \
             --tag ghcr.io/${{ github.repository_owner }}/lambda-shell-runtime:awscli-installer \
             --tag public.ecr.aws/l9f6r9f5/lambda-shell-runtime:awscli-installer \
-            --push \
+            --${{ env.PUSH == 'true' && 'push' || 'output=type=cacheonly' }} \
             -f - . << 'EOF'
           FROM public.ecr.aws/lambda/provided:al2023 AS awscli-installer
           RUN dnf install -y aws-cli && dnf clean all
-          EOF
+          EOF