From 811dab1c1468b860b484b83f28452945152082e9 Mon Sep 17 00:00:00 2001 From: Jose Garcia <47431411+ruxwez@users.noreply.github.com> Date: Sun, 25 Oct 2026 18:57:15 +0100 Subject: [PATCH] ci: Log in to Docker Hub before building The base image was pulled anonymously from the runner's shared IP, which can hit Docker Hub's anonymous pull limit and fail builds with 429. Log in before the build whenever secrets are available (everything except pull requests from forks). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01QTN7At86i5TYDmozENSNv8 --- .github/workflows/ci.yml | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 60eb512..b0e1308 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -105,6 +105,16 @@ jobs: - uses: actions/checkout@v4 - uses: docker/setup-buildx-action@v3 + # Before building, so pulling the postgres base image counts against our + # account instead of the anonymous limit of the shared runner IP. Pull + # requests from forks get no secrets, so they build anonymously. + - name: Log in to Docker Hub + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository + uses: docker/login-action@v3 + with: + username: ${{ secrets.DOCKER_USERNAME }} + password: ${{ secrets.DOCKER_PERSONAL_KEY }} + - name: Build uses: docker/bake-action@v6 with: @@ -133,13 +143,6 @@ jobs: path: /tmp/summary/${{ matrix.target }} retention-days: 1 - - name: Log in to Docker Hub - if: env.PUBLISH == 'true' - uses: docker/login-action@v3 - with: - username: ${{ secrets.DOCKER_USERNAME }} - password: ${{ secrets.DOCKER_PERSONAL_KEY }} - # Same build as above (served from the builder cache), pushed untagged. # The publish job stitches the per-arch digests into tagged manifests. - name: Push by digest