From 53aef3e4fdc73b35f6873d2ef062affd53884a0b Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Sat, 20 Jun 2026 10:34:29 -0400
Subject: [PATCH] build-and-push: optional Docker Hub login for dual-registry
 pushes

Adds a dockerhub-token secret + dockerhub-user input. When the token is set, the
build also logs in to Docker Hub so extra-tags referencing Docker Hub bare repos
(e.g. rehosting/penguin:latest) are pushed in the same build. Covers the common
publish-to-both-Harbor-and-Docker-Hub pattern (penguin/publish, fw2tar). Harbor-
only repos are unaffected (token unset => no Docker Hub login).
---
 .github/workflows/build-and-push.yml | 21 +++++++++++++++++++++
 README.md                            |  2 +-
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-and-push.yml b/.github/workflows/build-and-push.yml
index 95e8e83..c200782 100644
--- a/.github/workflows/build-and-push.yml
+++ b/.github/workflows/build-and-push.yml
@@ -83,6 +83,10 @@ on:
       fetch-depth:
         type: number
         default: 0
+      dockerhub-user:
+        description: Docker Hub username (used only when the dockerhub-token secret is set).
+        type: string
+        default: ""
     secrets:
       registry:
         description: Harbor host. Empty => external fork defaults are used.
@@ -91,6 +95,13 @@ on:
         required: false
       registry-password:
         required: false
+      dockerhub-token:
+        description: >-
+          Docker Hub token. When set, the build also logs in to Docker Hub, so
+          extra-tags that reference Docker Hub (bare repos like
+          rehosting/penguin:latest) are pushed there in the same build. Leave
+          unset for Harbor-only repos.
+        required: false
     outputs:
       image-ref:
         description: Fully-qualified image reference that was built
@@ -129,6 +140,16 @@ jobs:
           password: ${{ env.PASSWORD }}
           buildkit-image: ${{ inputs.buildkit-image }}
 
+      # Optional second registry: when a Docker Hub token is provided, log in so a
+      # single build can push both Harbor (TARGET/...) and Docker Hub (bare-repo)
+      # tags listed in extra-tags. Common for repos that publish to both.
+      - name: Log in to Docker Hub
+        if: ${{ secrets.dockerhub-token != '' }}
+        uses: docker/login-action@v3
+        with:
+          username: ${{ inputs.dockerhub-user }}
+          password: ${{ secrets.dockerhub-token }}
+
       - name: Compute image reference
         id: ref
         shell: bash
diff --git a/README.md b/README.md
index 714dc0a..fd9d152 100644
--- a/README.md
+++ b/README.md
@@ -47,7 +47,7 @@ this way.
 
 | Workflow | Purpose |
 |----------|---------|
-| `rehosting/ci/.github/workflows/build-and-push.yml@v1` | Build a Docker image and push to Harbor with the `:cache` / `:cache-PR-<n>` registry cache. Folds in the REGISTRY/USER/CACHE/TARGET/EXTERNAL_REGISTRY_PASS env ladder. |
+| `rehosting/ci/.github/workflows/build-and-push.yml@v1` | Build a Docker image and push to Harbor with the `:cache` / `:cache-PR-<n>` registry cache. Folds in the REGISTRY/USER/CACHE/TARGET/EXTERNAL_REGISTRY_PASS env ladder. Optionally also pushes Docker Hub tags from `extra-tags` when the `dockerhub-token` secret is set. |
 | `rehosting/ci/.github/workflows/toolchain-release.yml@v1` | Build a tarball inside a shared embedded-toolchain image and cut a versioned GitHub release. For the guest-utility repos. |
 | `rehosting/ci/.github/workflows/nix-release.yml@v1` | Install Nix (cached), `nix build`, tar the result, and cut a versioned release. The Nix counterpart of `toolchain-release`. |
 | `rehosting/ci/.github/workflows/update-flake-lock.yml@v1` | Scheduled job that opens a PR bumping `flake.lock`. |