ci: use configuration variables for Docker Hub and Quay.io usernames

[jefferyto]

I believe recent build failures (#211) are caused by GitHub redacting the Docker Hub and Quay.io usernames inside Docker tag names passed to buildx.

This changes the Docker Hub and Quay.io usernames to be stored as configuration variables, which are not redacted by GitHub, rather than as secrets.

[jefferyto]

I should note that I'm only guessing this will fix #211 as I don't have a practical way to debug the issue or test this fix. I think it is a good idea in general to store the usernames as variables instead of as secrets.

[efahl]

I just spent a while poking around and I'm still pretty hazy on what might be failing, but it seems to me that the secrets.*_USER values are set and passing through into the various replacements correctly, as evidenced by the fact that the logins are succeeding (here's a recent one https://github.com/openwrt/docker/actions/runs/33351815257/job/99366744712).

Then after that, it's only in the buildx where something is parsing the tags that it fails. The *** in the error doesn't surprise me, I assume that's just github CI redacting the log file, but if the arguments are processed in order, then the first one that fails is the firsts quay.io one, with all the ghcr and docker ones preceding it being accepted.

ERROR: failed to build: invalid tag "quay.io/***/imagebuilder:airoha-an7581-main": invalid reference format

Or, if buildx is not processing args in order, maybe all of the --tag entries are incorrect??? The docs say they look ok to me: https://docs.docker.com/reference/cli/docker/image/tag/

[jefferyto]

My guess is either the tags passed to buildx have literal asterisks (quay.io/***/imagebuilder:airoha-an7581-main) instead of the username, or have invisible delimiters (quay.io/[delimiter]openwrt[/delimiter]/imagebuilder:airoha-an7581-main) which is how GitHub is able to redact the usernames in logs. (Notice that not all instances of "openwrt" are redacted, just the ones corresponding to the "secret" usernames.) I believe either case results in invalid tags.

I think buildx is processing tags in random order and exiting with an error for the first invalid tag it finds, but this is also just a guess.

[efahl]

Notice that not all instances of "openwrt" are redacted, just the ones corresponding to the "secret" usernames.

Yeah, that does seem very strange, doesn't it? From what I've read, github's redaction algo is pretty stupid and brute force, so you'd expect all of them to get swapped. At this point, I'm betting on your idea about invisible delimiters.

@BKPepe Could you copy the *_USER values from secrets into vars and fire this off again, so we can see what happens?

[BKPepe]

Oh, @jefferyto is back! I did not notice that. Sorry guys, I did not look at it so far. :(( Hopefully in a few days, I will have some free time to look at it.

[jefferyto]

@BKPepe On Docker Hub and Quay, the organization name is "openwrt" but is the user name the same or different? If it is different then perhaps the issue is the workflow is trying to tag images for the user (quay.io/[username]/imagebuilder:airoha-an7581-main) instead of the organization (quay.io/openwrt/imagebuilder:airoha-an7581-main).

[jefferyto]

If the username is different then that explains why "openwrt" is not redacted in the logs.

Thinking more about this, I think it makes more sense for the usernames to be secret, since workflow logs are basically public. (So ignore this PR.)

If my second guess is correct then the fix would be to add secrets for the organization name.

[efahl]

If the username is different then that explains why "openwrt" is not redacted in the logs.

Oho, that makes a lot more more sense.

[BKPepe]

I created this PR: #213