From 4f7341b000fc1baf20b9b561c625ba6ab8870d75 Mon Sep 17 00:00:00 2001 From: William Desportes Date: Fri, 23 Oct 2026 22:17:32 +0200 Subject: [PATCH] Scope Docker Hub credentials to an environment Both jobs now reference the docker-hub environment, so the push token can be stored as an environment secret and stays out of every other job. The plan job logs in again so its inspects use the account rate limit instead of the shared anonymous one. The username is read from vars.DOCKERHUB_USERNAME, as docker/login-action documents, while DOCKERHUB_TOKEN remains a secret. Co-Authored-By: DeepSeek Signed-off-by: William Desportes --- .github/workflows/mirror-official-images.yml | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/.github/workflows/mirror-official-images.yml b/.github/workflows/mirror-official-images.yml index 2b2fb14..964980b 100644 --- a/.github/workflows/mirror-official-images.yml +++ b/.github/workflows/mirror-official-images.yml @@ -30,6 +30,11 @@ jobs: name: Plan runs-on: ubuntu-latest timeout-minutes: 20 + # Authenticated so that the inspects use the account's rate limit instead + # of the shared anonymous one + environment: + name: docker-hub + url: https://hub.docker.com/r/phpmyadmin/phpmyadmin outputs: matrix: ${{ steps.plan.outputs.matrix }} count: ${{ steps.plan.outputs.count }} @@ -43,7 +48,7 @@ jobs: - name: Log in to Docker Hub run: ./.github/scripts/mirror-official-images.sh login env: - DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} + DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USERNAME }} DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} - name: Plan the tags to sync id: plan @@ -55,6 +60,12 @@ jobs: if: ${{ needs.plan.outputs.count != '' && needs.plan.outputs.count != '0' }} runs-on: ubuntu-latest timeout-minutes: 90 + # DOCKERHUB_TOKEN must be a secret of this environment, not of the + # repository, for only the jobs referencing it to see it. The username is + # not sensitive, so it lives in vars.DOCKERHUB_USERNAME + environment: + name: docker-hub + url: https://hub.docker.com/r/phpmyadmin/phpmyadmin strategy: fail-fast: false max-parallel: 4 @@ -68,7 +79,7 @@ jobs: - name: Log in to Docker Hub run: ./.github/scripts/mirror-official-images.sh login env: - DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} + DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USERNAME }} DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} - name: Sync ${{ matrix.tag }} run: ./.github/scripts/mirror-official-images.sh mirror "${TAG}"