Skip to content

build-and-push: optional Docker Hub login for dual-registry pushes #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lacraig2 merged 1 commit into from
Jun 20, 2026
Merged

build-and-push: optional Docker Hub login for dual-registry pushes #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions .github/workflows/build-and-push.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,10 @@ on:
fetch-depth:
type: number
default: 0
dockerhub-user:
description: Docker Hub username (used only when the dockerhub-token secret is set).
type: string
default: ""
secrets:
registry:
description: Harbor host. Empty => external fork defaults are used.
Expand All @@ -91,6 +95,13 @@ on:
required: false
registry-password:
required: false
dockerhub-token:
description: >-
Docker Hub token. When set, the build also logs in to Docker Hub, so
extra-tags that reference Docker Hub (bare repos like
rehosting/penguin:latest) are pushed there in the same build. Leave
unset for Harbor-only repos.
required: false
outputs:
image-ref:
description: Fully-qualified image reference that was built
Expand Down Expand Up @@ -129,6 +140,16 @@ jobs:
password: ${{ env.PASSWORD }}
buildkit-image: ${{ inputs.buildkit-image }}

# Optional second registry: when a Docker Hub token is provided, log in so a
# single build can push both Harbor (TARGET/...) and Docker Hub (bare-repo)
# tags listed in extra-tags. Common for repos that publish to both.
- name: Log in to Docker Hub
if: ${{ secrets.dockerhub-token != '' }}
uses: docker/login-action@v3
with:
username: ${{ inputs.dockerhub-user }}
password: ${{ secrets.dockerhub-token }}

- name: Compute image reference
id: ref
shell: bash
Expand Down
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ this way.

| Workflow | Purpose |
|----------|---------|
| `rehosting/ci/.github/workflows/build-and-push.yml@v1` | Build a Docker image and push to Harbor with the `:cache` / `:cache-PR-<n>` registry cache. Folds in the REGISTRY/USER/CACHE/TARGET/EXTERNAL_REGISTRY_PASS env ladder. |
| `rehosting/ci/.github/workflows/build-and-push.yml@v1` | Build a Docker image and push to Harbor with the `:cache` / `:cache-PR-<n>` registry cache. Folds in the REGISTRY/USER/CACHE/TARGET/EXTERNAL_REGISTRY_PASS env ladder. Optionally also pushes Docker Hub tags from `extra-tags` when the `dockerhub-token` secret is set. |
| `rehosting/ci/.github/workflows/toolchain-release.yml@v1` | Build a tarball inside a shared embedded-toolchain image and cut a versioned GitHub release. For the guest-utility repos. |
| `rehosting/ci/.github/workflows/nix-release.yml@v1` | Install Nix (cached), `nix build`, tar the result, and cut a versioned release. The Nix counterpart of `toolchain-release`. |
| `rehosting/ci/.github/workflows/update-flake-lock.yml@v1` | Scheduled job that opens a PR bumping `flake.lock`. |
Expand Down