fix(ci): standardize GHCR auth on self-hosted workflows - #623
POWERFULMOVES wants to merge 9 commits into
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ec432ca931
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| REGISTRY: ghcr.io | ||
| IMAGE_PREFIX: ghcr.io/${{ github.repository_owner }} | ||
| GHCR_USERNAME: ${{ secrets.GHCR_USERNAME || github.actor }} | ||
| GHCR_PASSWORD: ${{ secrets.GHCR_TOKEN || secrets.GH_PAT_PUBLISH || github.token }} |
There was a problem hiding this comment.
This fallback order makes GH_PAT_PUBLISH win over github.token, so any repo that keeps GH_PAT_PUBLISH for clone-only use (without write:packages) will now fail GHCR auth in docker/login-action even though the workflow already grants packages: write and github.token would succeed; the same pattern was added in build-images.yml and self-hosted-builds-hardened.yml, so GHCR publishing can regress across self-hosted pipelines unless the default is switched back to github.token (with PAT only as an explicit override).
Useful? React with 👍 / 👎.
| if [ -z "$PRIMARY_TAG" ]; then | ||
| echo "::warning::No tags generated; GHCR login failed and Docker Hub credentials are absent. Build/push, scan, and sign steps will be skipped." | ||
| echo "has_tags=false" >> $GITHUB_OUTPUT |
There was a problem hiding this comment.
In .github/workflows/integrations-ghcr.yml, when GHCR login fails and Docker Hub creds are absent, this block only emits a warning and sets has_tags=false, and all build/push/scan/sign steps are then skipped by if: steps.meta.outputs.has_tags == 'true'; on push/scheduled runs that means the job can pass green while publishing and security scans never ran, which hides release failures instead of surfacing them.
Useful? React with 👍 / 👎.
|
Operator note for GHCR auth validation:\n\n- This branch now supports PAT fallback via GHCR_TOKEN / GH_PAT_PUBLISH with explicit GHCR_USERNAME.\n- Current repo secrets already include GHCR_USERNAME and GH_PAT_PUBLISH; if login still fails, rotate GH_PAT_PUBLISH to a token with write:packages + |
|
Added a follow-up CI integrity commit for production audit readiness:
This should eliminate the immediate 0s "workflow file issue" failures seen on prior SHA runs; old failed checks on earlier commits are expected/stale. |
Docker Hardening ValidationHardening Validation ReportValidated: Sun 15 Feb 2026 02:48:15 PM UTCServices CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
|
Superseded by #624 merge into PMOVES.AI-Edition-Hardened (CI/hardening and integration gate fixes now landed there). Closing to avoid duplicate/conflicting workflow edits. |
2 participants
Summary\n- standardize GHCR auth inputs across self-hosted workflows using GHCR_USERNAME/GHCR_TOKEN with safe fallbacks\n- keep github.token as the default path while supporting PAT override for runner/service-account scenarios\n- add explicit packages: write permission in the deprecated self-hosted workflow to avoid token-scope drift\n- update secrets onboarding + CI image docs with PAT username/token pairing guidance\n\n## Why\nSome runs fail at docker/login-action@v3 with denied: denied when a PAT is used without a matching username or when workflow token scopes differ across runners. This makes GHCR auth deterministic for hardened/self-hosted pipelines.\n\n## Validation\n- parsed updated workflow YAML files via python + yaml.safe_load\n- manually audited login-action steps in:\n - .github/workflows/integrations-ghcr.yml\n - .github/workflows/build-images.yml\n - .github/workflows/self-hosted-builds.yml\n - .github/workflows/self-hosted-builds-hardened.yml\n