From cdbdcd344866f5e0528a88a48694419025b293bf Mon Sep 17 00:00:00 2001
From: "MUH. IQRAM BAHRING" <MUHIQRAMBAHRING@GMAIL.COM>
Date: Sun, 30 Aug 2026 23:47:01 +0800
Subject: [PATCH] ci(docker): pin actions by SHA, add concurrency, exclude
 tests from build context

---
 .dockerignore                        |  5 +++++
 .github/workflows/docker-publish.yml | 16 ++++++++++------
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index 5b921cd9..584c09d2 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,6 +1,11 @@
 # VCS
 .git
 **/.git
+.github
+
+# Test suites (not needed for the image build)
+tests
+**/tests
 
 # Editor
 .vscode
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 270f71b6..96c1e369 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -6,6 +6,10 @@ on:
       - "v*"
   workflow_dispatch:
 
+concurrency:
+  group: docker-build-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   GHCR_IMAGE: ghcr.io/${{ github.repository }}
   DOCKERHUB_IMAGE: mhiqrambhrng/9router-mibp-version
@@ -18,26 +22,26 @@ jobs:
       packages: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
         with:
           images: |
             ${{ env.GHCR_IMAGE }}
@@ -47,7 +51,7 @@ jobs:
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
         with:
           context: .
           push: true