Skip to content

ci: support multi-platform Docker image build (amd64 + arm64) #298

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
FletcherMan merged 3 commits into from
Mar 13, 2026
Merged

ci: support multi-platform Docker image build (amd64 + arm64) #298

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
525434c
ci: support multi-platform Docker image build (amd64 + arm64)
Mar 13, 2026
c6cf593
ci: add workflow_dispatch for manual Docker image build
Mar 13, 2026
afa199c
ci: fix incorrect COMMIT and VERSION on manual dispatch
Mar 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 40 additions & 22 deletions .github/workflows/docker_release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,38 +4,56 @@ on:
push:
tags:
- morph-v*
workflow_dispatch:
inputs:
tag:
description: 'Tag name to build (e.g. morph-v2.2.0)'
required: true

env:
IMAGE_NAME: go-ethereum
IMAGE_NAME: ghcr.io/${{ github.repository }}

jobs:
push:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4
with:
ref: ${{ inputs.tag || github.ref }}

- name: Log into registry
run: echo "${{ secrets.PACKAGE_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
- name: Set up QEMU
uses: docker/setup-qemu-action@v3

- name: Build the Docker image
run: |
docker build . --file Dockerfile \
--build-arg COMMIT="${{ github.sha }}" \
--build-arg VERSION="${{ github.ref_name }}" \
-t "${IMAGE_NAME}"
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Push image
- name: Log into registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.PACKAGE_TOKEN }}

Comment on lines +31 to +37

@coderabbitai coderabbitai Bot Mar 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

For docker/login-action@v3 with ghcr.io, does username need to match the owner of a PAT used as password, and is github.actor safe when the PAT belongs to a bot/service account?

💡 Result:

Yes—when authenticating to GHCR (ghcr.io) with a PAT, the username is expected to be the GitHub username of the account that owns the token (i.e., the user/bot that created the PAT). GitHub’s docker/OCI registry login examples explicitly treat USERNAME as “your GitHub username.” [1][2]

github.actor is only correct when the credential is also for the actor (most commonly when using secrets.GITHUB_TOKEN, which is tied to the workflow run’s context and the action examples use github.actor). [3] If your password is a PAT that belongs to a bot/service account, then using username: ${{ github.actor }} is not safe/reliable (it may be a human user, dependabot, etc.)—set username to the bot/service account’s login instead. [1][2][3]

Sources
[1] GitHub Docs – Working with the Container registry (GHCR) (docker login example) (docs.github.com)
[2] GitHub Docs – Working with the Docker registry (Enterprise Server) (explicitly “replace USERNAME with your GitHub username”) (docs.github.com)
[3] docker/login-action README (GHCR example uses username: ${{ github.actor }} with GITHUB_TOKEN) (github.com)

Citations:

GHCR authentication will fail if PACKAGE_TOKEN is a bot/service account PAT and tag is pushed by a different user.

When authenticating to GHCR with a PAT, the username must match the account that owns the token. Using ${{ github.actor }} (line 28) works only if the PAT owner and tag pusher are the same. If secrets.PACKAGE_TOKEN is a bot account's PAT, any tag pushed by a human user will fail login.

Recommended fix: Either switch to secrets.GITHUB_TOKEN with explicit package permissions, or store the bot account username in a separate secret.

Option 1: Use GITHUB_TOKEN (recommended) 
 jobs:
   push:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Log into registry
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.PACKAGE_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
Option 2: Keep PAT but use correct username 
       - name: Log into registry
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
-          username: ${{ github.actor }}
+          username: ${{ secrets.PACKAGE_USERNAME }}
           password: ${{ secrets.PACKAGE_TOKEN }}

Add PACKAGE_USERNAME secret with the bot account's username.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Log into registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.PACKAGE_TOKEN }}
- name: Log into registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ secrets.PACKAGE_USERNAME }}
password: ${{ secrets.PACKAGE_TOKEN }}
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/docker_release.yml around lines 24 - 30, The GHCR login
step using docker/login-action@v3 currently sets username to ${{ github.actor }}
which will fail when the PAT in secrets.PACKAGE_TOKEN belongs to a bot; update
the "Log into registry" step to either (a) switch to using ${{
secrets.GITHUB_TOKEN }} as the password and ensure workflow permissions include
packages: write (recommended), or (b) keep PACKAGE_TOKEN but replace username
with a new secret holding the PAT owner's username (e.g.,
secrets.PACKAGE_USERNAME) so the docker/login-action fields registry, username
and password match the token owner; adjust the workflow step that references
registry/username/password accordingly.

- name: Extract version
id: version
run: |
IMAGE_ID="ghcr.io/${{ github.repository }}"

# Change all uppercase to lowercase
IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
# Strip "morph-v" prefix from tag name
VERSION=$(echo "${{ github.ref_name }}" | sed -e 's/^morph-v//')
echo IMAGE_ID="$IMAGE_ID"
echo VERSION="$VERSION"
docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
docker tag "$IMAGE_NAME" "$IMAGE_ID:latest"
docker push "$IMAGE_ID:$VERSION"
docker push "$IMAGE_ID:latest"
TAG="${{ inputs.tag || github.ref_name }}"
VERSION=$(echo "$TAG" | sed -e 's/^morph-v//')
echo "version=${VERSION}" >> $GITHUB_OUTPUT

Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
- name: Build and push
uses: docker/build-push-action@v6
with:
context: .
file: Dockerfile
platforms: linux/amd64,linux/arm64
push: true
tags: |
${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}
${{ env.IMAGE_NAME }}:latest
build-args: |
COMMIT=${{ github.sha }}
VERSION=${{ inputs.tag || github.ref_name }}
cache-from: type=gha
cache-to: type=gha,mode=max
Loading