Update GitHub Actions workflows

* Fix build.yml to trigger only on specific ci/ files rather than ci/**
* Remove pull_request push to Docker Hub; PRs now build-only, push on
  merge to main or via workflow_dispatch
* Fix "Export Full Conda Environment" step in both build workflows to
  reference the image tag just built rather than the stale :main tag
* Update all actions to latest versions
* Switch bot commits from personal account to github-actions[bot]
* Remove UPDATE_LOCKFILE_TOKEN PAT; GITHUB_TOKEN with contents: write
  is sufficient since we no longer need to trigger downstream workflows
* Add PR comment after lock file update directing users to
  workflow_dispatch to build a test image

Author: ateucher

.github/workflows/build-stable.yml

@@ -10,25 +10,25 @@ jobs:
       run:
         shell: bash -l {0}
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
     - name: "Set Job Environment Variables"
       run: |
         echo "RELEASE_DATE=$(date +'%Y-%m-%d')" >> $GITHUB_ENV
 
     - name: "Set up QEMU"
-      uses: docker/setup-qemu-action@v2
+      uses: docker/setup-qemu-action@v4
 
     - name: "Set up Docker Buildx"
-      uses: docker/setup-buildx-action@v2
+      uses: docker/setup-buildx-action@v4
 
     - name: "Login to Docker Hub"
-      uses: docker/login-action@v2
+      uses: docker/login-action@v4.1.0
       with:
         username: openscapes
         password: ${{ secrets.DOCKERHUB_TOKEN }}
 
     - name: "Build and push"
-      uses: docker/build-push-action@v4
+      uses: docker/build-push-action@v7.1.0
       with:
         context: ci
         push: true

.github/workflows/build.yml

@@ -6,21 +6,27 @@ on:
       - main
       - dev
     paths:
-      # build if anything in ci/ changes except only environment.yml because 
-      # environment-lock.yml needs to be built first by create-conda-lock.yml
-      - 'ci/**'
-      - '!ci/environment.yml'
+      - 'ci/conda-lock.yml'
+      - 'ci/Dockerfile'
+      - 'ci/apt.txt'
+      - 'ci/postBuild'
+      - 'ci/start'
+      - 'ci/install-vscode-ext.sh'
+      - 'ci/vscode-extensions.txt'
       - '.github/workflows/build.yml'
 
   pull_request:
     branches:
       - main
       - dev
     paths:
-      # build if anything in ci/ changes except only environment.yml because 
-      # environment-lock.yml needs to be built first by create-conda-lock.yml
-      - 'ci/**'
-      - '!ci/environment.yml'
+      - 'ci/conda-lock.yml'
+      - 'ci/Dockerfile'
+      - 'ci/apt.txt'
+      - 'ci/postBuild'
+      - 'ci/start'
+      - 'ci/install-vscode-ext.sh'
+      - 'ci/vscode-extensions.txt'
       - '.github/workflows/build.yml'
 
   workflow_dispatch:
@@ -41,24 +47,25 @@ jobs:
           echo "DOCKER_TAG=${DOCKER_TAG}" >> $GITHUB_ENV
 
       - name: "Set up QEMU"
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v4
 
       - name: "Set up Docker Buildx"
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v4
 
       - name: "Login to Docker Hub"
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4.1.0
         with:
           username: openscapes
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: "Build and push"
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v7.1.0
         with:
           context: ci
-          push: true
+          push: ${{ github.event_name != 'pull_request' }}
           tags: openscapes/python:latest, openscapes/python:${{ env.DOCKER_TAG }}
 
       - name: Export Full Conda Environment
+        if: github.event_name != 'pull_request'
         run: |
-          docker run openscapes/python:main conda list --export
+          docker run openscapes/python:${{ env.DOCKER_TAG }} conda list --export

.github/workflows/create-conda-lock.yml

@@ -17,6 +17,7 @@ on:
   workflow_dispatch:
 permissions:
   contents: write
+  pull-requests: write
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -26,7 +27,7 @@ jobs:
       with:
         ref: ${{ github.head_ref }}
     - name: install conda-lock with micromamba
-      uses: mamba-org/setup-micromamba@main
+      uses: mamba-org/setup-micromamba@v2
       with:
         environment-name: locker
         create-args: conda-lock
@@ -37,12 +38,20 @@ jobs:
       run: |
         conda-lock lock --mamba --file environment.yml --platform linux-64
     - name: commit changes to tracked files
-      env: 
-        GH_TOKEN: ${{ secrets.UPDATE_LOCKFILE_TOKEN }}
+      id: commit
       run: |
         if [[ $(git ls-files --modified) ]]; then
-          git config --global user.name 'ateucher'
-          git config --global user.email '2816635+ateucher@users.noreply.github.com'
+          git config --global user.name 'github-actions[bot]'
+          git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'
           git commit --all --message "[bot] autogenerated conda-lock files"
           git push
+          echo "committed=true" >> $GITHUB_OUTPUT
         fi
+
+    - name: comment on PR
+      if: steps.commit.outputs.committed == 'true' && github.event_name == 'pull_request'
+      uses: peter-evans/create-or-update-comment@v4
+      with:
+        issue-number: ${{ github.event.pull_request.number }}
+        body: |
+          `conda-lock.yml` has been updated. To build and test a Docker image from this branch, trigger the [Build and push Docker image](../actions/workflows/build.yml) workflow manually and select this branch.