ci: fix registry image namespaces - #213
Merged
Merged
Conversation
BKPepe
force-pushed
the
registry-namespace
branch
from
September 14, 2026 15:32
99850fb to
5477d2b
Compare
Registry image names were derived from the login user, which breaks Quay.io robot accounts (org+name) and can push Docker Hub images to the wrong namespace. Use the repository owner as the default namespace, with optional DOCKER_NAMESPACE and QUAY_NAMESPACE overrides. Reuse the computed namespace for both login and image tagging, and keep registry tokens out of the workflow environment. Fixes: openwrt#211 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The Push step ran the whole build again with no-cache, so the pushed image was not the one that passed the smoke test. Tag the image ID from the Build step and push it after the smoke test, so exactly the tested image is published. Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The workflow does not set any permissions, so every job gets the repository default, which grants write access to everything. Drop all permissions by default and grant each job only what it needs: reading the repository, and writing packages to push to ghcr.io. Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
BKPepe
force-pushed
the
registry-namespace
branch
from
September 14, 2026 21:40
5477d2b to
979b139
Compare
Contributor
|
Looks like @jefferyto's insight about the user name is indeed the culprit. #212 (comment) |
Contributor
|
Commit it and let's see if it does the pushes. Even if it burns, it can't be any worse that what we've got now, we haven't had a run go through for a couple months now... |
Member
Author
|
@aparcar needs to merge this. I dont have commit rights here. |
Member
Author
|
@aparcar Can you merge this, please? |
Member
|
Thanks, looks good to me |
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since #204, registry image names are derived from the login user. This
breaks Quay.io robot accounts (
org+name) and can also push Docker Hubimages to the wrong namespace.
This PR:
DOCKER_NAMESPACE/QUAY_NAMESPACEoverrides for forks;GITHUB_TOKENpermissions tocontents: readandpackages: write.RootFS images are now pushed as single-platform manifests, without the
provenance attestation.
Tested with act and a fork using Docker Hub and a Quay.io robot account:
all images were pushed to ghcr.io, Docker Hub and Quay.io with the
expected tags and matching digests, and the pushed RootFS image passed
the feeds test.
Fixes #211