remkomolier/docker-hash

Compute a deterministic SHA-256 hash for a Docker image build from the Dockerfile, build args, and COPY/ADD sources.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 10, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: remkomolier/docker-hash@64dbafb1abfc1e26bc9124998668f17f9c28b4c4 # v0.3.14

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
file	Path to the Dockerfile, relative to the workflow's checkout.	no	Dockerfile
context	Path to the build context directory, relative to the workflow's checkout.	no	.
build-args	Build arguments to include in the hash, one NAME=VALUE per line. Values may contain `=` characters; only the first `=` separates name and value. Empty lines and lines starting with `#` are ignored.	no	""
export-env-name	Optional environment variable name to receive the computed hash. When set, the action also writes `<name>=<digest>` to `$GITHUB_ENV` so later steps in the same job can read it directly. The name must be a valid shell identifier (`[A-Za-z_][A-Za-z0-9_]*`) and may not start with `GITHUB_` or `RUNNER_` (reserved by the runner).	no	""
no-resolve-from	Set to "true" to skip resolving FROM image digests against the upstream registry. FROM references are still expanded against ARG/ENV state and the base-image hash entry is still canonicalized offline (so `alpine` and `alpine:latest` produce the same base-image entry), but no network calls are made. Combine with `no-expand-args: "true"` to reproduce the v0.1.x hash shape exactly. Default: "false" (resolution is on).	no	false
no-expand-args	Set to "true" to disable ARG/ENV expansion in COPY/ADD source paths, `--from=` stage names and FROM image/platform references. With this flag set, a FROM line containing a `$VAR` reference causes docker-hash to fail rather than silently ignore the variable. Combine with `no-resolve-from: "true"` to reproduce the v0.1.x hash shape exactly. Default: "false" (expansion is on).	no	false
platform	Force a specific platform (e.g. "linux/amd64") when resolving FROM image digests for multi-arch images. Empty (the default) hashes the multi-arch index digest, which keeps the hash stable across runner architectures. Per-FROM `--platform=` flags in the Dockerfile always take precedence over this value.	no	""
auth-file	Path to a registry auth file in Docker `config.json` or Podman/Skopeo `auth.json` format. When set, this is passed through to the underlying CLI as `--auth-file`, which sets `REGISTRY_AUTH_FILE` for the current run; the default keychain still consults the other auth sources ($HOME/.docker/config.json, $DOCKER_CONFIG, $XDG_RUNTIME_DIR/containers/auth.json) per their normal lookup order. Same semantic as the Skopeo/Podman/Buildah `--authfile` flag. Most workflows will not need this — `actions/checkout` plus `docker/login-action` already populate the default Docker config.	no	""
registries-conf	Path to a Podman-style `registries.conf` TOML file describing per- registry mirrors. When set (and `no-resolve-from` is not "true"), FROM digest resolution is routed through the configured mirrors, with fallback to the upstream registry on connection error or HTTP 5xx. The file uses the same `[[registry]]` / `[[registry.mirror]]` schema Podman, Buildah, Skopeo and CRI-O already consume, so an existing `/etc/containers/registries.conf` checked into the runner image (or mounted via `actions/checkout`) can be reused as-is. There is no auto-discovery: the path must be provided explicitly.	no	""
check	Optional image-reference template to probe against the registry. When set, the action checks whether a tag matching the template already exists in the registry and exposes the result as the `exists` step output. The template must contain a literal `{hash}` placeholder which is substituted with the computed digest, e.g. `my-reg/app:build-{hash}` or `ghcr.io/org/app:build-{hash}-amd64`. A manifest 404 surfaces as `exists=no` (the step still succeeds so downstream jobs can branch on it); a registry/auth/network error fails the step. Authentication re-uses the same keychain as FROM resolution, so a prior `docker/login-action` works transparently.	no	""

Outputs

name	description
hash	The 64-character hex SHA-256 digest computed by docker-hash.
exists	"yes" if the image referenced by the rendered `check` template exists in the registry, "no" if the registry returned 404, or empty when `check` was not provided. Registry/auth/network errors fail the step rather than surfacing here.