-
Notifications
You must be signed in to change notification settings - Fork 93
ci(scripts): keep every released image public on Docker Hub #2303
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
ce4dd6c
ci(scripts): keep every released image public on Docker Hub :construc…
fredcamaral a3c0a71
build(deps): bump lib-commons to v6.7.0 :arrow_up:
fredcamaral 27cd6e9
ci(scripts): harden the Docker Hub visibility gate :construction_worker:
fredcamaral 9e56e8f
ci(workflows): serialize and time-box the visibility job :constructio…
fredcamaral File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| name: Docker Hub Visibility | ||
|
|
||
| # Docker Hub creates a repository on first push with the organization's default | ||
| # visibility (private), and the shared release pipeline never changes it, so every | ||
| # new image ships unpullable until someone flips it by hand. Callable from the | ||
| # release pipeline as a pre-push gate, and dispatchable to repair the images that | ||
| # already went out private. | ||
| on: | ||
| workflow_call: | ||
| secrets: | ||
| DOCKER_USERNAME: | ||
| required: true | ||
| DOCKERHUB_IMAGE_PUSH_TOKEN: | ||
| required: true | ||
| workflow_dispatch: | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| ensure-public: | ||
| name: Ensure released images are public | ||
| runs-on: blacksmith-4vcpu-ubuntu-2404 | ||
| timeout-minutes: 10 | ||
| # Serialize runs: a release run and a manual repair run racing the same 404 both | ||
| # POST /repositories/ and the loser fails on a non-201. Job-level (not workflow-level) | ||
| # because a called reusable workflow only honors concurrency on its jobs. | ||
| concurrency: | ||
| group: dockerhub-visibility-${{ github.repository }} | ||
| cancel-in-progress: false | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - name: Ensure Docker Hub repositories are public | ||
| env: | ||
| DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }} | ||
| DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_IMAGE_PUSH_TOKEN }} | ||
| run: ./scripts/ensure-dockerhub-public.sh | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,144 @@ | ||
| #!/bin/bash | ||
|
|
||
| # Copyright (c) 2026 Lerian Studio. All rights reserved. | ||
| # Use of this source code is governed by the Elastic License 2.0 | ||
| # that can be found in the LICENSE file. | ||
|
|
||
| # Ensure every image the release pipeline publishes exists on Docker Hub and is public. | ||
| # | ||
| # Docker Hub creates a repository on first push using the organization's default | ||
| # visibility, which is private. Nothing in the release pipeline flips it, so each new | ||
| # image ships unpullable until someone changes it by hand: midaz-tracer, | ||
| # midaz-tracer-migrations and midaz-ledger-migrations all answer denied/unauthorized | ||
| # today, which breaks any anonymous `helm install` of the midaz chart. | ||
| # | ||
| # This script is idempotent: it pre-creates missing repositories as public and flips | ||
| # existing private ones. Run it before the images are pushed so a first release never | ||
| # lands private. | ||
| # | ||
| # Env: DOCKERHUB_USERNAME, DOCKERHUB_TOKEN (Docker Hub PAT), optional DOCKERHUB_NAMESPACE | ||
| # and RELEASE_WORKFLOW. | ||
|
|
||
| set -euo pipefail | ||
|
|
||
| API="https://hub.docker.com/v2" | ||
| NAMESPACE="${DOCKERHUB_NAMESPACE:-lerianstudio}" | ||
| RELEASE_WORKFLOW="${RELEASE_WORKFLOW:-.github/workflows/release.yml}" | ||
| ATTEMPTS=3 | ||
|
|
||
| : "${DOCKERHUB_USERNAME:?DOCKERHUB_USERNAME is required}" | ||
| : "${DOCKERHUB_TOKEN:?DOCKERHUB_TOKEN is required}" | ||
|
|
||
| BODY=$(mktemp) | ||
| PAYLOAD_FILE=$(mktemp) | ||
| trap 'rm -f "$BODY" "$PAYLOAD_FILE"' EXIT | ||
|
|
||
| # hub_call <method> <url> [json-payload] | ||
| # Writes the response body to $BODY, prints the HTTP status, and retries transport | ||
| # errors and 5xx so a flaky Docker Hub cannot fail a release on its own. The payload | ||
| # goes through a file so secrets (the login call) never appear on curl's argv, and | ||
| # curl's exit code is captured separately: on a transport error curl already prints | ||
| # "000" for %{http_code}, so appending a fallback would produce "000000" and dodge | ||
| # the retry branch. | ||
| hub_call() { | ||
| local method="$1" url="$2" payload="${3:-}" status="" attempt=1 | ||
| local args=(-sS -o "$BODY" -w '%{http_code}' --connect-timeout 10 --max-time 60 -X "$method") | ||
|
|
||
| if [ -n "${TOKEN:-}" ]; then | ||
| args+=(-H "Authorization: Bearer ${TOKEN}") | ||
| fi | ||
| if [ -n "$payload" ]; then | ||
| printf '%s' "$payload" >"$PAYLOAD_FILE" | ||
| args+=(-H 'Content-Type: application/json' -d "@${PAYLOAD_FILE}") | ||
| fi | ||
|
|
||
| while [ "$attempt" -le "$ATTEMPTS" ]; do | ||
| if ! status=$(curl "${args[@]}" "$url" </dev/null); then | ||
| status="000" | ||
| fi | ||
|
|
||
| case "$status" in | ||
| 000|5??) attempt=$((attempt + 1)); sleep $((attempt * 2)) ;; | ||
| *) break ;; | ||
| esac | ||
| done | ||
|
coderabbitai[bot] marked this conversation as resolved.
|
||
|
|
||
| echo "$status" | ||
| } | ||
|
|
||
| # The GitOps mapping is the release pipeline's own registry of published images (one | ||
| # "<image>.tag" key per image), so deriving the list from it cannot drift from what the | ||
| # pipeline actually pushes. It is a single-line, single-quoted JSON scalar; bail out | ||
| # rather than guess if that ever stops holding. | ||
| mappings=$(sed -n "s/^[[:space:]]*gitops_yaml_key_mappings:[[:space:]]*'\(.*\)'[[:space:]]*$/\1/p" "$RELEASE_WORKFLOW") | ||
| images=$(printf '%s' "$mappings" | jq -er 'keys[] | sub("\\.tag$"; "")' 2>/dev/null | sort -u || true) | ||
|
|
||
| if [ -z "$images" ]; then | ||
| echo "error: could not read gitops_yaml_key_mappings from ${RELEASE_WORKFLOW}" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Login goes through hub_call so it gets the same retry and timeout policy as every | ||
| # other request: a single 5xx or a stalled connection at login must not fail a release. | ||
| login_payload=$(jq -n --arg u "$DOCKERHUB_USERNAME" --arg p "$DOCKERHUB_TOKEN" '{username: $u, password: $p}') | ||
| status=$(hub_call POST "${API}/users/login/" "$login_payload") | ||
| TOKEN=$(jq -r '.token // empty' "$BODY" 2>/dev/null || true) | ||
|
|
||
| if [ "$status" != "200" ] || [ -z "$TOKEN" ]; then | ||
| echo "error: Docker Hub login failed for ${DOCKERHUB_USERNAME} (HTTP ${status})" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| failed=0 | ||
|
|
||
| while read -r image; do | ||
| [ -n "$image" ] || continue | ||
|
|
||
| repo="${NAMESPACE}/${image}" | ||
| status=$(hub_call GET "${API}/repositories/${repo}/") | ||
|
|
||
| case "$status" in | ||
| 200) | ||
| # Only trust an explicit boolean. A missing field or a malformed body means the | ||
| # visibility was never confirmed, and this script's job is verification, so that | ||
| # must fail rather than pass as "already public". (Not `.is_private // "unknown"`: | ||
| # jq's // treats false as empty, which would flag every public repo as unknown.) | ||
| is_private=$(jq -r '.is_private | if type == "boolean" then tostring else "unknown" end' "$BODY" 2>/dev/null || echo "unknown") | ||
| case "$is_private" in | ||
| true) | ||
| status=$(hub_call PATCH "${API}/repositories/${repo}/" '{"is_private": false}') | ||
| if [ "$status" = "200" ]; then | ||
| echo "${repo}: was private, now public" | ||
| else | ||
| echo "error: ${repo}: could not make public (HTTP ${status})" >&2 | ||
| failed=1 | ||
| fi | ||
| ;; | ||
| false) | ||
| echo "${repo}: already public" | ||
| ;; | ||
| *) | ||
| echo "error: ${repo}: response did not report is_private" >&2 | ||
| failed=1 | ||
| ;; | ||
| esac | ||
| ;; | ||
| 404) | ||
| payload=$(jq -n --arg ns "$NAMESPACE" --arg name "$image" \ | ||
| '{namespace: $ns, name: $name, is_private: false}') | ||
| status=$(hub_call POST "${API}/repositories/" "$payload") | ||
| if [ "$status" = "201" ]; then | ||
| echo "${repo}: created as public" | ||
| else | ||
| echo "error: ${repo}: could not create (HTTP ${status})" >&2 | ||
| failed=1 | ||
| fi | ||
| ;; | ||
| *) | ||
| echo "error: ${repo}: unexpected response (HTTP ${status})" >&2 | ||
| failed=1 | ||
| ;; | ||
| esac | ||
| done <<<"$images" | ||
|
|
||
| exit "$failed" | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.