From cef4797ddededfe12973ceaba83fe13929c3396e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89rico=20Andrei?= <ericof@plone.org>
Date: Thu, 8 Oct 2026 15:47:11 -0300
Subject: [PATCH] Build test images locally instead of pushing them

The test job pushed the builder and prod-config images to Docker Hub
so the main image could build FROM them, which needs registry
credentials. Workflows triggered by Dependabot or by forks do not get
Actions secrets, so the job failed at the login step on those pull
requests.

Drop the Buildx setup so the default builder (docker driver) keeps
each image in the runner's local image store, and remove the login,
the pushes, the pull and the DOCKER_HUB environment.
---
 .github/workflows/test.yml       | 17 ++++-------------
 news/+test-without-push.internal |  1 +
 2 files changed, 5 insertions(+), 13 deletions(-)
 create mode 100644 news/+test-without-push.internal

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b308cd7..b2f07c2 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -27,7 +27,6 @@ jobs:
 
   test:
     runs-on: ubuntu-latest
-    environment: DOCKER_HUB
     needs:
       - meta
     steps:
@@ -62,14 +61,10 @@ jobs:
           tags: |
             type=sha
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to Docker Hub Container Registry
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      # No Buildx setup: the default builder uses the docker driver, so each
+      # image lands in the local image store and the main image can build
+      # FROM the other two without a registry. This keeps the job free of
+      # secrets, which pull requests from forks and Dependabot do not get.
 
       - name: Build builder image for testing
         uses: docker/build-push-action@v4
@@ -77,7 +72,6 @@ jobs:
           context: ./
           file: Dockerfile.builder
           tags: ${{ steps.meta-builder.outputs.tags }}
-          push: true
           build-args: |
             PLONE_VERSION=${{ needs.meta.outputs.PLONE_VERSION }}
 
@@ -87,7 +81,6 @@ jobs:
           context: ./
           file: Dockerfile.prod
           tags: ${{ steps.meta-prod-config.outputs.tags }}
-          push: true
 
       - name: Build main image for testing
         uses: docker/build-push-action@v4
@@ -95,11 +88,9 @@ jobs:
           context: ./
           file: Dockerfile
           tags: ${{ steps.meta-main.outputs.tags }}
-          push: true
           build-args: |
             PLONE_VERSION=${{ needs.meta.outputs.SHA }}
 
       - name: Test
         run: |
-          docker pull ${{ steps.meta-main.outputs.tags }}
           ./test/run.sh  ${{ steps.meta-main.outputs.tags }}
diff --git a/news/+test-without-push.internal b/news/+test-without-push.internal
new file mode 100644
index 0000000..c510ff0
--- /dev/null
+++ b/news/+test-without-push.internal
@@ -0,0 +1 @@
+Changed the image test workflow to build and test the images locally instead of pushing them to Docker Hub, so it no longer needs registry credentials and also runs on Dependabot and fork pull requests. @ericof