ci: stop uploading Docker build records and summaries

docker/build-push-action uploads a build record (*.dockerbuild) for every image
build. The record stores every build-arg value in plain text, and on a public
repo any signed-in GitHub user can download it. Set DOCKER_BUILD_RECORD_UPLOAD
and DOCKER_BUILD_SUMMARY to false at workflow level in every workflow that uses
the action. BuildKit secrets are never recorded, so nothing else changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/docker-build-publish-demo.yml

@@ -29,6 +29,13 @@ permissions:
   contents: read
   packages: write
 
+# docker/build-push-action uploads a build record (*.dockerbuild) and a job summary for every build.
+# The record holds every build-arg value in plain text, and on a public repo anyone signed in to
+# GitHub can download it, so neither is produced. (BuildKit `secrets:` are never recorded.)
+env:
+  DOCKER_BUILD_RECORD_UPLOAD: false
+  DOCKER_BUILD_SUMMARY: false
+
 jobs:
   gauzy-api:
     runs-on: ${{ vars.RUNNER_LINUX_X64_8 || 'ubuntu-latest' }}

.github/workflows/docker-build-publish-mcp-auth-demo.yml

@@ -24,6 +24,13 @@ concurrency:
   # delays the image that IS wanted by exactly that long.
   group: gauzy-docker-build-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+# docker/build-push-action uploads a build record (*.dockerbuild) and a job summary for every build.
+# The record holds every build-arg value in plain text, and on a public repo anyone signed in to
+# GitHub can download it, so neither is produced. (BuildKit `secrets:` are never recorded.)
+env:
+  DOCKER_BUILD_RECORD_UPLOAD: false
+  DOCKER_BUILD_SUMMARY: false
+
 jobs:
   gauzy-mcp-auth:
     runs-on: ${{ vars.RUNNER_LINUX_X64_8 || 'ubuntu-latest' }}

.github/workflows/docker-build-publish-mcp-auth-prod.yml

@@ -13,6 +13,13 @@ concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
 
+# docker/build-push-action uploads a build record (*.dockerbuild) and a job summary for every build.
+# The record holds every build-arg value in plain text, and on a public repo anyone signed in to
+# GitHub can download it, so neither is produced. (BuildKit `secrets:` are never recorded.)
+env:
+  DOCKER_BUILD_RECORD_UPLOAD: false
+  DOCKER_BUILD_SUMMARY: false
+
 jobs:
   gauzy-mcp-auth:
     runs-on: ${{ vars.RUNNER_LINUX_X64_8 || 'ubuntu-latest' }}

.github/workflows/docker-build-publish-mcp-auth-stage.yml

@@ -23,6 +23,13 @@ concurrency:
   # delays the image that IS wanted by exactly that long.
   group: gauzy-docker-build-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+# docker/build-push-action uploads a build record (*.dockerbuild) and a job summary for every build.
+# The record holds every build-arg value in plain text, and on a public repo anyone signed in to
+# GitHub can download it, so neither is produced. (BuildKit `secrets:` are never recorded.)
+env:
+  DOCKER_BUILD_RECORD_UPLOAD: false
+  DOCKER_BUILD_SUMMARY: false
+
 jobs:
   gauzy-mcp-auth:
     runs-on: ${{ vars.RUNNER_LINUX_X64_8 || 'ubuntu-latest' }}

.github/workflows/docker-build-publish-mcp-demo.yml

@@ -24,6 +24,13 @@ concurrency:
   # delays the image that IS wanted by exactly that long.
   group: gauzy-docker-build-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+# docker/build-push-action uploads a build record (*.dockerbuild) and a job summary for every build.
+# The record holds every build-arg value in plain text, and on a public repo anyone signed in to
+# GitHub can download it, so neither is produced. (BuildKit `secrets:` are never recorded.)
+env:
+  DOCKER_BUILD_RECORD_UPLOAD: false
+  DOCKER_BUILD_SUMMARY: false
+
 jobs:
   gauzy-mcp:
     runs-on: ${{ vars.RUNNER_LINUX_X64_8 || 'ubuntu-latest' }}

.github/workflows/docker-build-publish-mcp-prod.yml

@@ -13,6 +13,13 @@ concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
 
+# docker/build-push-action uploads a build record (*.dockerbuild) and a job summary for every build.
+# The record holds every build-arg value in plain text, and on a public repo anyone signed in to
+# GitHub can download it, so neither is produced. (BuildKit `secrets:` are never recorded.)
+env:
+  DOCKER_BUILD_RECORD_UPLOAD: false
+  DOCKER_BUILD_SUMMARY: false
+
 jobs:
   gauzy-mcp:
     runs-on: ${{ vars.RUNNER_LINUX_X64_8 || 'ubuntu-latest' }}

.github/workflows/docker-build-publish-mcp-stage.yml

@@ -23,6 +23,13 @@ concurrency:
   # delays the image that IS wanted by exactly that long.
   group: gauzy-docker-build-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+# docker/build-push-action uploads a build record (*.dockerbuild) and a job summary for every build.
+# The record holds every build-arg value in plain text, and on a public repo anyone signed in to
+# GitHub can download it, so neither is produced. (BuildKit `secrets:` are never recorded.)
+env:
+  DOCKER_BUILD_RECORD_UPLOAD: false
+  DOCKER_BUILD_SUMMARY: false
+
 jobs:
   gauzy-mcp:
     runs-on: ${{ vars.RUNNER_LINUX_X64_8 || 'ubuntu-latest' }}

.github/workflows/docker-build-publish-prod.yml

@@ -16,6 +16,13 @@ permissions:
   contents: read
   packages: write
 
+# docker/build-push-action uploads a build record (*.dockerbuild) and a job summary for every build.
+# The record holds every build-arg value in plain text, and on a public repo anyone signed in to
+# GitHub can download it, so neither is produced. (BuildKit `secrets:` are never recorded.)
+env:
+  DOCKER_BUILD_RECORD_UPLOAD: false
+  DOCKER_BUILD_SUMMARY: false
+
 jobs:
   gauzy-api:
     runs-on: ${{ vars.RUNNER_LINUX_X64_8 || 'ubuntu-latest' }}

.github/workflows/docker-build-publish-stage.yml

@@ -27,6 +27,13 @@ permissions:
   contents: read
   packages: write
 
+# docker/build-push-action uploads a build record (*.dockerbuild) and a job summary for every build.
+# The record holds every build-arg value in plain text, and on a public repo anyone signed in to
+# GitHub can download it, so neither is produced. (BuildKit `secrets:` are never recorded.)
+env:
+  DOCKER_BUILD_RECORD_UPLOAD: false
+  DOCKER_BUILD_SUMMARY: false
+
 jobs:
   gauzy-api:
     runs-on: ${{ vars.RUNNER_LINUX_X64_8 || 'ubuntu-latest' }}