From bca54dfbbb535f5679322676e215379142cec9d1 Mon Sep 17 00:00:00 2001 From: Jose Garcia <47431411+ruxwez@users.noreply.github.com> Date: Sun, 25 Oct 2026 19:21:39 +0100 Subject: [PATCH] ci: Use a dedicated token for the Docker Hub description Updating the description failed with "Forbidden": DOCKER_PERSONAL_KEY only has the "Read & Write" scope, which is enough to push images but not to edit the repository page, which needs "Read, Write, Delete". Use a separate DOCKERHUB_DESCRIPTION_TOKEN secret so the build jobs keep a token that can't delete anything, and fail with an explicit message when the secret is missing. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01QTN7At86i5TYDmozENSNv8 --- .github/workflows/dockerhub-description.yml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dockerhub-description.yml b/.github/workflows/dockerhub-description.yml index f6b4b9f..c4644b0 100644 --- a/.github/workflows/dockerhub-description.yml +++ b/.github/workflows/dockerhub-description.yml @@ -18,13 +18,25 @@ jobs: update: name: Update description runs-on: ubuntu-latest + env: + # Editing the description needs a Docker Hub token with the + # "Read, Write, Delete" scope. It's kept apart from DOCKER_PERSONAL_KEY, + # which only needs "Read & Write" to push images, so the build jobs + # never get permission to delete anything. + TOKEN: ${{ secrets.DOCKERHUB_DESCRIPTION_TOKEN }} steps: + - name: Check token + if: env.TOKEN == '' + run: | + echo "::error::Missing secret DOCKERHUB_DESCRIPTION_TOKEN: a Docker Hub access token with the 'Read, Write, Delete' scope." + exit 1 + - uses: actions/checkout@v4 - uses: peter-evans/dockerhub-description@v4 with: username: ${{ secrets.DOCKER_USERNAME }} - password: ${{ secrets.DOCKER_PERSONAL_KEY }} + password: ${{ env.TOKEN }} repository: ruxwez/postgres short-description: PostgreSQL 14-18 with pgvector, PostGIS and pgmq. Official image, amd64 + arm64. readme-filepath: README.md