build(deps): bump docker/metadata-action from 5 to 6 - #4653

🔍 Dependency Analysis Summary

Single-line change in .github/workflows/publish_image.yml:56. No Python (uv.lock/pyproject.toml) or JS (package.json/pnpm-lock.yaml) dependencies touched — this does not affect the application runtime, only the release-tag publishing workflow.

Overall risk: LOW

📋 Detailed Changelog Review

Package: docker/metadata-action (v5 → v6)

v5's last release was v5.10.0; the v6 tag currently resolves to v6.2.0.

Changes (v6.0.0 is the only release with behaviour changes beyond dependency bumps):

• Node 24 as the default runtime (requires Actions Runner ≥ v2.327.1) — node 24 as default runtime docker/metadata-action#605
• List inputs now preserve # inside values while still stripping full-line # comments — preserve comments in list input values with commentNoInfix docker/metadata-action#607
• Internals switched to ESM; bundle rewiring — switch to ESM and update config/test wiring docker/metadata-action#602
• Dependency bumps: @actions/core 1.11.1→3.0.0, @actions/github 6.0.1→9.0.0, @docker/actions-toolkit 0.68.0→0.79.0, lodash 4.17.21→4.17.23, semver, @isaacs/brace-expansion

v6.1.0 and v6.2.0 are dependency/security bumps plus an esbuild name-preservation tweak — no behaviour changes.

Also inherited from the v5.7–v5.10 line (already available on @v5, so not new here): the tag-names output, the is_not_default_branch global expression, and partial-match support for semver/pep440 types.

Breaking Changes: Node 24 runtime requirement. The action's action.yml on v6 declares using: node24, main: dist/index.cjs.

Security Fixes: transitive only (lodash, brace-expansion, tar, semver, sigstore). No advisory affecting the action's own code.

Migration Notes: none for this repo's usage — see below. Inputs (context, images, tags, flavor, labels, annotations, sep-*, bake-target, github-token) and outputs (version, tags, tag-names, labels, annotations, json, bake-file*) are unchanged from v5. The semver / pattern={{version}} / pattern={{major}}.{{minor}} tag types behave identically.

⚠️ Impact Assessment

Breaking changes affecting OCS: No. Both v6 breaking items are non-issues here:

1. Node 24 runner requirement — every workflow runs on GitHub-hosted ubuntu-latest (no self-hosted runners anywhere in .github/workflows/), whose runner is well past v2.327.1. More directly: the same job already runs actions/checkout@v7 and docker/build-push-action@v7, both of which declare using: node24. The requirement is already satisfied and proven in this exact job.
2. List-input # parsing — the tags input (publish_image.yml:61-63) contains type=semver,pattern={{version}} and type=semver,pattern={{major}}.{{minor}}, neither of which contains a #. The explanatory # comments on lines 59-60 sit outside the tags: block as YAML comments, so they never reach the action's parser. No labels or annotations inputs are passed.

Affected files: .github/workflows/publish_image.yml only — the sole docker/metadata-action usage in the repo.

Test impact: none. No test code references this action.

Configuration changes: none required.

🛠️ Recommendations

Action required: nothing in the diff.

Testing focus — the one genuine caveat: publish_image.yml triggers only on push: tags: 'v*' and has no workflow_dispatch, so nothing in this PR's CI exercises the changed step. The first execution of @v6 will be a real release build. Two low-cost ways to de-risk that:

• Cut a pre-release tag (e.g. v<next>-rc1) first. The workflow's own comment on lines 59-60 notes that metadata-action withholds latest from pre-releases, so an rc tag is a safe smoke test of tag derivation.
• Or verify on the next release that steps.meta.outputs.tags still yields exactly the :X.Y.Z, :X.Y and :latest tags under ghcr.io/<repo>, and that labels is still populated — an empty labels output would silently ship an image without OCI labels rather than fail the build.

Follow-up tasks: optional — harden-runner in this workflow is SHA-pinned while the Docker actions use floating major tags. Not a regression introduced here, but if full SHA pinning of third-party actions is a goal, this is one of the files to sweep.

Merge path note: scripts/pr_risk_gate.py lists .github/** under BLOCKED_PATHS ("CI/CD definition"), so this PR is labelled risk:high and is excluded from auto_merge_low_risk.yml. A human merge is required by design.

Merge recommendation: APPROVE — major version bump, but no breaking change reaches this repo's usage. Just be aware the step is first exercised at release time.

📚 Useful Links

• v6.0.0 release notes
• v5.10.0 to v6.0.0 compare
• docker/metadata-action#607 — list input # handling
• docker/metadata-action#605 — Node 24 runtime
• Actions Runner v2.327.1
• Action README