ci(scripts): keep every released image public on Docker Hub - #2303

Description

Docker Hub creates a repository on first push using the organization's default visibility, which is private, and the shared release pipeline never changes it. So an image is public only if someone remembered to flip it by hand, and the v4 images nobody flipped went out unpullable:

That breaks an anonymous helm install of the midaz chart on every v4 component: the ledger pulls, its migration Job and the whole tracer surface ImagePullBackOff.

This adds a dockerhub-visibility workflow that ensures each released repository exists and is public, and gates the release pipeline on it so a new image never exists private in the first place:

jobs:
  dockerhub-visibility:
    uses: ./.github/workflows/dockerhub-visibility.yml
    secrets: inherit

  pipeline:
    needs: dockerhub-visibility
    uses: LerianStudio/github-actions-shared-workflows/.github/workflows/go-release.yml@v1.46.5

scripts/ensure-dockerhub-public.sh does the work: pre-create missing repositories with is_private: false, PATCH existing private ones, no-op on public ones, and fail the job if any repository is still private at the end. It authenticates with the DOCKER_USERNAME / DOCKERHUB_IMAGE_PUSH_TOKEN pair the build already uses, and retries transport errors and 5xx so a flaky Docker Hub cannot fail a release on its own.

The image list is not a second hardcoded copy: it is derived from gitops_yaml_key_mappings, the pipeline's own registry of published images, so it cannot drift from what actually gets pushed.

mappings=$(sed -n "s/^[[:space:]]*gitops_yaml_key_mappings:[[:space:]]*'\(.*\)'[[:space:]]*$/\1/p" "$RELEASE_WORKFLOW")
images=$(printf '%s' "$mappings" | jq -er 'keys[] | sub("\\.tag$"; "")' | sort -u)
# -> midaz-ledger, midaz-ledger-migrations, midaz-tracer, midaz-tracer-migrations

The workflow is also workflow_dispatch-able, so once this lands on develop a single manual run repairs the three repositories that already went out private, without waiting for the next release.

One prerequisite worth confirming before merge: DOCKERHUB_IMAGE_PUSH_TOKEN must be allowed to change repository settings, not only push tags. If it is push-only, the job fails loudly with the offending repository and HTTP status instead of silently leaving an image private.

Type of Change

• ci: CI pipeline or workflow changes

Breaking Changes

None. No Go code, no image contents, no tags change; only the visibility of the repositories the pipeline publishes to.

Testing

actionlint and shellcheck are clean on the new workflow and script. The script was exercised against a stubbed Docker Hub covering every branch: already-public no-op, private repository flipped, missing repository created, PATCH denied (403), login failure, unreadable mapping, and a 503 that retries three times and then fails.

lerianstudio/midaz-ledger: already public
lerianstudio/midaz-ledger-migrations: created as public
lerianstudio/midaz-tracer: was private, now public
lerianstudio/midaz-tracer-migrations: created as public

Related Issues

Blocks the midaz v4 Helm work in LerianStudio/helm#1838, which cannot ship a working default install while these three images are private.