Arch Linux: Build and push arch-toolbox image workflow (containers/toolbox)

The Arch Linux: Build and push arch-toolbox image workflow from containers/toolbox, explained and optimized by Latchkey.

CI health: B - good

Point runs-on at Latchkey and get job timeouts, SHA-pinned actions, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: containers/toolbox.github/workflows/arch-images.yamlLicense Apache-2.0View source

What it does

This is the Arch Linux: Build and push arch-toolbox image workflow from the containers/toolbox repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

name: "Arch Linux: Build and push arch-toolbox image"

permissions: read-all

on:
  pull_request:
    branches:
      - main
    paths:
      - images/arch/**
      - .github/workflows/arch-images.yaml
  push:
    branches:
      - main
    paths:
      - images/arch/**
      - .github/workflows/arch-images.yaml
  schedule:
    - cron: '0 0 * * MON'

env:
  distro: 'arch'
  platforms: 'linux/amd64'
  registry: 'quay.io/toolbx'
  username: 'toolbx+github'

# Prevent multiple workflow runs from racing to ensure that pushes are made
# sequentially for the main branch. Also cancel in progress workflow runs for
# pull requests only.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build-push-images:
    name: Build and push the arch-toolbox image

    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build container image (latest tag)
        uses: redhat-actions/buildah-build@v2
        if: env.latest_release == matrix.release
        with:
          platforms: ${{ env.platforms }}
          context: images/${{ env.distro }}
          image: ${{ env.distro }}-toolbox
          tags: latest
          containerfiles: images/${{ env.distro }}/Containerfile
          layers: false
          oci: true

      - name: Push to Container Registry (latest tag)
        uses: redhat-actions/push-to-registry@v2
        id: push-latest
        if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main'
        with:
          username: ${{ env.username }}
          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
          image: ${{ env.distro }}-toolbox
          registry: ${{ env.registry }}
          tags: latest

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

name: "Arch Linux: Build and push arch-toolbox image"
 
permissions: read-all
 
on:
  pull_request:
    branches:
      - main
    paths:
      - images/arch/**
      - .github/workflows/arch-images.yaml
  push:
    branches:
      - main
    paths:
      - images/arch/**
      - .github/workflows/arch-images.yaml
  schedule:
    - cron: '0 0 * * MON'
 
env:
  distro: 'arch'
  platforms: 'linux/amd64'
  registry: 'quay.io/toolbx'
  username: 'toolbx+github'
 
# Prevent multiple workflow runs from racing to ensure that pushes are made
# sequentially for the main branch. Also cancel in progress workflow runs for
# pull requests only.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
jobs:
  build-push-images:
    timeout-minutes: 30
    name: Build and push the arch-toolbox image
 
    runs-on: latchkey-small
    steps:
      - name: Checkout
        uses: actions/checkout@v4
 
      - name: Build container image (latest tag)
        uses: redhat-actions/buildah-build@v2
        if: env.latest_release == matrix.release
        with:
          platforms: ${{ env.platforms }}
          context: images/${{ env.distro }}
          image: ${{ env.distro }}-toolbox
          tags: latest
          containerfiles: images/${{ env.distro }}/Containerfile
          layers: false
          oci: true
 
      - name: Push to Container Registry (latest tag)
        uses: redhat-actions/push-to-registry@v2
        id: push-latest
        if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main'
        with:
          username: ${{ env.username }}
          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
          image: ${{ env.distro }}-toolbox
          registry: ${{ env.registry }}
          tags: latest

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Add a job timeout so a hung step cannot burn hours of runner time.

2 third-party actions are referenced by a movable tag. Pin them to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow

actions/checkout