hoverkraft-tech · neilime · Apr 9, 2026 · Apr 9, 2026
diff --git a/.github/workflows/__test-action-docker-build-image.yml b/.github/workflows/__test-action-docker-build-image.yml
@@ -42,11 +42,16 @@ jobs:
 
       - name: Assert - Check built image output
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          BUILT_IMAGE_OUTPUT: ${{ steps.build-image.outputs.built-image }}
         with:
           script: |
             const assert = require("assert");
+            const pullRequestNumber = context.payload.pull_request?.number;
+            const refName = process.env.GITHUB_REF_NAME;
+            const defaultBranch = context.payload.repository?.default_branch;
 
-            const builtImageOutput = ${{ toJSON(steps.build-image.outputs.built-image) }};
+            const builtImageOutput = process.env.BUILT_IMAGE_OUTPUT;
             assert(builtImageOutput, `"built-image" output is empty`);
 
             let builtImage;
@@ -111,20 +116,20 @@ jobs:
 
             const expectedTags = [];
             let expectedImageVersion;
-            if (`${{ github.event_name }}` === "pull_request") {
-              const shortSha = `${{ github.sha }}`.substring(0, 7);
-              const prShaTag = `pr-${{ github.event.pull_request.number }}-${shortSha}`;
-              const prTag = `pr-${{ github.event.pull_request.number }}`;
+            if (context.eventName === "pull_request") {
+              const shortSha = context.sha.substring(0, 7);
+              const prShaTag = `pr-${pullRequestNumber}-${shortSha}`;
+              const prTag = `pr-${pullRequestNumber}`;
 
               expectedTags.push(prShaTag, prTag);
               expectedImageVersion = prTag;
             } else {
-              const refTag = `${{ github.ref_name }}`;
+              const refTag = refName;
               expectedTags.push(refTag);
               expectedImageVersion = refTag;
 
-              const isTag = `${{ github.ref }}`.startsWith('refs/tags/');
-              const isPushOnDefaultBranch = `${{ github.event_name }}` === "push" && !isTag && refTag === "${{ github.event.repository.default_branch }}";
+              const isTag = context.ref.startsWith('refs/tags/');
+              const isPushOnDefaultBranch = context.eventName === "push" && !isTag && refTag === defaultBranch;
 
               if (isPushOnDefaultBranch) {
                 expectedTags.push("latest");
@@ -202,11 +207,13 @@ jobs:
 
       - name: Assert - Check built image output
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          BUILT_IMAGE_OUTPUT: ${{ steps.build-image.outputs.built-image }}
         with:
           script: |
             const assert = require("assert");
 
-            const builtImageOutput = ${{ toJSON(steps.build-image.outputs.built-image) }};
+            const builtImageOutput = process.env.BUILT_IMAGE_OUTPUT;
             assert(builtImageOutput, `"built-image" output is empty`);
 
             let builtImage;
@@ -303,11 +310,13 @@ jobs:
 
       - name: Assert - Check built image output
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          BUILT_IMAGE_OUTPUT: ${{ steps.build-image.outputs.built-image }}
         with:
           script: |
             const assert = require("assert");
 
-            const builtImageOutput = ${{ toJSON(steps.build-image.outputs.built-image) }};
+            const builtImageOutput = process.env.BUILT_IMAGE_OUTPUT;
             assert(builtImageOutput, `"built-image" output is empty`);
 
             let builtImage;

diff --git a/.github/workflows/__test-action-docker-prune-pull-requests-image-tags.yml b/.github/workflows/__test-action-docker-prune-pull-requests-image-tags.yml
@@ -114,7 +114,7 @@ jobs:
               const packagePayload = {
                 package_type: 'container',
                 package_name: packageName,
-                org: process.env.GITHUB_REPOSITORY_OWNER,
+                org: context.repo.owner,
               };
 
               // Ensure that package exists
@@ -192,7 +192,7 @@ jobs:
               const packagePayload = {
                 package_type: 'container',
                 package_name: packageName,
-                org: process.env.GITHUB_REPOSITORY_OWNER,
+                org: context.repo.owner,
               };
 
               // Ensure that package still exists
@@ -267,6 +267,6 @@ jobs:
               return github.rest.packages.deletePackageForOrg({
                 package_type: 'container',
                 package_name: packageName,
-                org: process.env.GITHUB_REPOSITORY_OWNER,
+                org: context.repo.owner,
               });
             }));
diff --git a/.github/workflows/__test-action-get-image-metadata.yml b/.github/workflows/__test-action-get-image-metadata.yml
@@ -27,15 +27,23 @@ jobs:
 
       - name: Assert - Check get image metadata ouputs
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          IMAGE_OUTPUT: ${{ steps.get-image-metadata.outputs.image }}
+          LABELS_OUTPUT: ${{ steps.get-image-metadata.outputs.labels }}
+          ANNOTATIONS_OUTPUT: ${{ steps.get-image-metadata.outputs.annotations }}
+          TAGS_OUTPUT: ${{ steps.get-image-metadata.outputs.tags }}
         with:
           script: |
             const assert = require("assert");
+            const pullRequestNumber = context.payload.pull_request?.number;
+            const refName = process.env.GITHUB_REF_NAME;
+            const defaultBranch = context.payload.repository?.default_branch;
 
-            const imageOutput = `${{ steps.get-image-metadata.outputs.image }}`;
+            const imageOutput = process.env.IMAGE_OUTPUT;
             assert(imageOutput.length, `"image" output is empty`);
             assert.equal(imageOutput,"ghcr.io/hoverkraft-tech/ci-github-container/application-test", `"image" output is not valid`);
 
-            const labelsOutput = `${{ steps.get-image-metadata.outputs.labels }}`;
+            const labelsOutput = process.env.LABELS_OUTPUT;
             assert(labelsOutput.length, `"labels" output is empty`);
             assert(
               labelsOutput.startsWith("org.opencontainers.image.created"),
@@ -51,7 +59,7 @@ jobs:
               `"labels" output is not valid`
             );
 
-            const annotationsOutput = `${{ steps.get-image-metadata.outputs.annotations }}`;
+            const annotationsOutput = process.env.ANNOTATIONS_OUTPUT;
             assert(annotationsOutput.length, `"annotations" output is empty`);
 
             const expectedManifestAnnotations = expectedLabels.split("\n").map(line => {
@@ -74,26 +82,26 @@ jobs:
               `"annotations - manifest-descriptor" output is not valid`
             );
 
-            const tagsOutput = `${{ steps.get-image-metadata.outputs.tags }}`;
+            const tagsOutput = process.env.TAGS_OUTPUT;
             assert(tagsOutput.length, `"tags" output is empty`);
 
             const tags = tagsOutput.split("\n").filter(Boolean);
             assert(tags.length, `"tags" output is empty`);
 
             const expectedTags = [];
 
-            if (`${{ github.event_name }}` === "pull_request") {
-              const shortSha = `${{ github.sha }}`.substring(0, 7);
-              const prShaTag = `pr-${{ github.event.pull_request.number }}-${shortSha}`;
-              const prTag = `pr-${{ github.event.pull_request.number }}`;
+            if (context.eventName === "pull_request") {
+              const shortSha = context.sha.substring(0, 7);
+              const prShaTag = `pr-${pullRequestNumber}-${shortSha}`;
+              const prTag = `pr-${pullRequestNumber}`;
 
               expectedTags.push(prShaTag, prTag);
             } else {
-              const refTag = `${{ github.ref_name }}`;
+              const refTag = refName;
               expectedTags.push(refTag);
 
-              const isTag = `${{ github.ref }}`.startsWith('refs/tags/');
-              const isPushOnDefaultBranch = `${{ github.event_name }}` === "push" && !isTag && refTag === "${{ github.event.repository.default_branch }}";
+              const isTag = context.ref.startsWith('refs/tags/');
+              const isPushOnDefaultBranch = context.eventName === "push" && !isTag && refTag === defaultBranch;
 
               if (isPushOnDefaultBranch) {
                 expectedTags.push("latest");
@@ -103,7 +111,7 @@ jobs:
             assert.equal(
               tags.length,
               expectedTags.length,
-              `"tags" output must contain ${expectedTags.length} tags for ${{ github.event_name }} event`
+              `"tags" output must contain ${expectedTags.length} tags for ${context.eventName} event`
             );
 
             for(const expectedTag of expectedTags) {
@@ -134,11 +142,13 @@ jobs:
 
       - name: Assert - Check get image metadata ouputs
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          TAGS_OUTPUT: ${{ steps.get-image-metadata.outputs.tags }}
         with:
           script: |
             const assert = require("assert");
 
-            const tagsOutput = `${{ steps.get-image-metadata.outputs.tags }}`;
+            const tagsOutput = process.env.TAGS_OUTPUT;
             assert(tagsOutput.length, `"tags" output is empty`);
             assert.equal(
               tagsOutput,

diff --git a/.github/workflows/__test-action-get-image-name.yml b/.github/workflows/__test-action-get-image-name.yml
@@ -26,13 +26,16 @@ jobs:
 
       - name: Check get image name ouputs
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          IMAGE_NAME_OUTPUT: ${{ steps.get-image-name.outputs.image-name }}
+          FULL_IMAGE_NAME_OUTPUT: ${{ steps.get-image-name.outputs.image-name-with-registry }}
         with:
           script: |
             /* jscpd:ignore-start */
             const assert = require("assert");
 
-            const imageNameOutput = `${{ steps.get-image-name.outputs.image-name }}`;
-            const fullImageNameOutput = `${{ steps.get-image-name.outputs.image-name-with-registry }}`;
+            const imageNameOutput = process.env.IMAGE_NAME_OUTPUT;
+            const fullImageNameOutput = process.env.FULL_IMAGE_NAME_OUTPUT;
 
             assert(imageNameOutput.length, `"image-name" output is empty`);
             assert.equal(
@@ -68,13 +71,16 @@ jobs:
 
       - name: Check get image name ouput
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          IMAGE_NAME_OUTPUT: ${{ steps.get-image-name.outputs.image-name }}
+          FULL_IMAGE_NAME_OUTPUT: ${{ steps.get-image-name.outputs.image-name-with-registry }}
         with:
           script: |
             /* jscpd:ignore-start */
             const assert = require("assert");
 
-            const imageNameOutput = `${{ steps.get-image-name.outputs.image-name }}`;
-            const fullImageNameOutput = `${{ steps.get-image-name.outputs.image-name-with-registry }}`;
+            const imageNameOutput = process.env.IMAGE_NAME_OUTPUT;
+            const fullImageNameOutput = process.env.FULL_IMAGE_NAME_OUTPUT;
 
             assert(imageNameOutput.length, `"image-name" output is empty`);
             assert.equal(

diff --git a/.github/workflows/__test-action-helm-parse-chart-uri.yml b/.github/workflows/__test-action-helm-parse-chart-uri.yml
@@ -26,15 +26,19 @@ jobs:
 
       - name: Assert - Check parse chart URI ouputs
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          REPOSITORY_OUTPUT: ${{ steps.parse-chart-uri.outputs.repository }}
+          NAME_OUTPUT: ${{ steps.parse-chart-uri.outputs.name }}
+          VERSION_OUTPUT: ${{ steps.parse-chart-uri.outputs.version }}
         with:
           script: |
             const assert = require("assert");
 
-            const repositoryOutput = `${{ steps.parse-chart-uri.outputs.repository }}`;
+            const repositoryOutput = process.env.REPOSITORY_OUTPUT;
             assert.equal(repositoryOutput,"ghcr.io/my-org/my-repo/charts/application", `"repository" output is not valid`);
 
-            const nameOutput = `${{ steps.parse-chart-uri.outputs.name }}`;
+            const nameOutput = process.env.NAME_OUTPUT;
             assert.equal(nameOutput,"my-repo", `"name" output is not valid`);
 
-            const versionOutput = `${{ steps.parse-chart-uri.outputs.version }}`;
+            const versionOutput = process.env.VERSION_OUTPUT;
             assert.equal(versionOutput,"0.1.0", `"version" output is not valid`);
diff --git a/.github/workflows/__test-workflow-docker-build-images-building.yml b/.github/workflows/__test-workflow-docker-build-images-building.yml
@@ -55,11 +55,13 @@ jobs:
     steps:
       - name: Check built images ouput
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          BUILT_IMAGES_OUTPUT: ${{ needs.act-build-images-args-secrets.outputs.built-images }}
         with:
           script: |
             const assert = require("assert");
 
-            const builtImagesOutput = `${{ needs.act-build-images-args-secrets.outputs.built-images }}`;
+            const builtImagesOutput = process.env.BUILT_IMAGES_OUTPUT;
             assert(builtImagesOutput.length, `"built-images" output is empty`);
 
             // Check if is valid Json

diff --git a/.github/workflows/__test-workflow-docker-build-images-caching.yml b/.github/workflows/__test-workflow-docker-build-images-caching.yml
@@ -141,28 +141,31 @@ jobs:
         env:
           BUILT_IMAGES: ${{ needs[matrix.cache-type == 'registry' && 'act-build-images-registry' || 'act-build-images-gha' ].outputs.built-images }}
           EXPECTED_IMAGE: ghcr.io/${{ github.repository }}/${{ matrix.image-name }}
+          IMAGE_NAME: ${{ matrix.image-name }}
         with:
           script: |
             const assert = require("assert");
+            const pullRequestNumber = context.payload.pull_request?.number;
+            const refName = process.env.GITHUB_REF_NAME;
 
             let expectedTag;
 
-            const isPullRequest = `${{ github.event_name }}` === "pull_request";
+            const isPullRequest = context.eventName === "pull_request";
             if (isPullRequest) {
-              const shortSha = `${{ github.sha }}`.substring(0, 7);
-              expectedTag = `pr-${{ github.event.pull_request.number }}-${shortSha}`;
+              const shortSha = context.sha.substring(0, 7);
+              expectedTag = `pr-${pullRequestNumber}-${shortSha}`;
             } else {
-              expectedTag = `${{ github.ref_name }}`;
+              expectedTag = refName;
             }
 
             const builtImages = JSON.parse(process.env.BUILT_IMAGES);
 
-            const imageName = `${{ matrix.image-name }}`;
+            const imageName = process.env.IMAGE_NAME;
             assert(builtImages[imageName], `"built-images" output does not contain "${imageName}" image`);
 
             const digest = builtImages[imageName].digest;
-            assert(digest.length, `"built-images" output does not contain digest for "${{ matrix.image-name }}" image`);
-            assert.match(digest, /^sha256:[0-9a-f]{64}$/, `"built-images" output does not contain valid digest for "${{ matrix.image-name }}" image`);
+            assert(digest.length, `"built-images" output does not contain digest for "${imageName}" image`);
+            assert.match(digest, /^sha256:[0-9a-f]{64}$/, `"built-images" output does not contain valid digest for "${imageName}" image`);
 
             const expectedImage = process.env.EXPECTED_IMAGE;
             const expectedImageTag = `${expectedImage}:${expectedTag}@${digest}`;
@@ -182,6 +185,14 @@ jobs:
           EXPECTED_CACHE_TAG: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}
         with:
           script: |
+            const shouldAssertCache = context.eventName === 'pull_request'
+              || (context.eventName === 'push' && !context.ref.startsWith('refs/tags/'));
+
+            if (!shouldAssertCache) {
+              core.info(`Skipping cache assertion for ${context.eventName} on ${context.ref}.`);
+              return;
+            }
+
             const expectedCacheImage = `${process.env.EXPECTED_IMAGE}/cache:${process.env.EXPECTED_CACHE_TAG}`;
             const expectedPlatforms = JSON.parse(process.env.EXPECTED_PLATFORMS);
             const expectedCacheImages = expectedPlatforms.map(platform => `${expectedCacheImage}-${platform.replace('/', '-')}`);

diff --git a/.github/workflows/__test-workflow-docker-build-images-multi-registry.yml b/.github/workflows/__test-workflow-docker-build-images-multi-registry.yml
@@ -59,7 +59,9 @@ jobs:
         with:
           script: |
             const assert = require("assert");
-            const sha = `${{ github.sha }}`;
+            const sha = context.sha;
+            const pullRequestNumber = context.payload.pull_request?.number;
+            const refName = process.env.GITHUB_REF_NAME;
 
             const builtImages = JSON.parse(process.env.BUILT_IMAGES);
             const builtImage = builtImages["test-multi-registry-inputs"];
@@ -68,9 +70,9 @@ jobs:
             assert.equal(builtImage.registry, "ghcr.io", `"registry" output is not valid`);
             assert.match(builtImage.digest, /^sha256:[0-9a-f]{64}$/, `"digest" output is not valid`);
 
-            const expectedTag = `${{ github.event_name }}` === "pull_request"
-              ? `pr-${{ github.event.pull_request.number }}-${sha.substring(0, 7)}`
-              : `${{ github.ref_name }}`;
+            const expectedTag = context.eventName === "pull_request"
+              ? `pr-${pullRequestNumber}-${sha.substring(0, 7)}`
+              : refName;
 
             const expectedImage = `${process.env.EXPECTED_IMAGE}:${expectedTag}@${builtImage.digest}`;
             assert.equal(builtImage.images[0], expectedImage, `"image" output is not valid`);
@@ -84,5 +86,13 @@ jobs:
           EXPECTED_CACHE_TAG: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}
         with:
           script: |
+            const shouldAssertCache = context.eventName === "pull_request"
+              || (context.eventName === "push" && !context.ref.startsWith("refs/tags/"));
+
+            if (!shouldAssertCache) {
+              core.info(`Skipping cache assertion for ${context.eventName} on ${context.ref}.`);
+              return;
+            }
+
             const cacheImage = `${process.env.EXPECTED_CACHE_IMAGE}:${process.env.EXPECTED_CACHE_TAG}-linux-amd64`;
             await exec.exec("docker", ["manifest", "inspect", cacheImage]);
diff --git a/.github/workflows/__test-workflow-docker-build-images-platforms-and-signing.yml b/.github/workflows/__test-workflow-docker-build-images-platforms-and-signing.yml
@@ -144,7 +144,7 @@ jobs:
               {
                 package_type: "container",
                 package_name: `ci-github-container/${process.env.IMAGE_NAME}`,
-                org: `${{ github.repository_owner }}`,
+                org: context.repo.owner,
                 per_page: 100
               }
             );