SETUP GUIDE

Dockerfile Change Risk

Use Change Risk to inspect selected Dockerfile and compose configuration changes without executing their contents.

Before you start

  • The GitHub Action or another authenticated Change Risk path
  • A repository containing the static files you want to analyse

Setup

  1. Add Dockerfile and, when relevant, compose.yaml to the selected file list.
  2. Open a pull request that changes one of those files.
  3. Review deterministic findings and evidence in the AntOps result.
  4. Resolve the underlying change in source control, then let a new analysis show the updated state.
files: |
  Dockerfile
  compose.yaml
  main.tf
  openapi.yaml

Verify and expected result

AntOps reads the provided text for deterministic analysis. It does not run docker build, pull images, start containers or change your runtime.

An analysis record reports the selected static changes and any resulting findings. An unchanged rerun does not create a new material change by itself.

Common safe checks

A file is not analysed

Add its repository-relative path to the workflow’s file list and make sure the pull request contains the intended change.

Security and revocation

Do not put registry passwords, API keys or production environment files into the workflow input. Use repository secrets for the AntOps API key.

Remove the path from the workflow or remove the workflow and its API key secret.