ci(scripts): stop the visibility gate from blocking every release by fredcamaral · Pull Request #2304 · LerianStudio/midaz

fredcamaral · 2026-08-06T07:44:18Z

Description

The first Release run after #2303 merged failed and skipped pipeline, so releases on develop are blocked right now:

lerianstudio/midaz-ledger: already public
error: lerianstudio/midaz-ledger-migrations: could not make public (HTTP 403)
error: lerianstudio/midaz-tracer: could not make public (HTTP 403)
error: lerianstudio/midaz-tracer-migrations: could not make public (HTTP 403)

Login and the reads worked (it correctly saw midaz-ledger public and the other three private), so this is not a bug in the check: DOCKERHUB_IMAGE_PUSH_TOKEN can push tags but cannot change repository settings, and Docker Hub answers 403 on the PATCH. A gate that can neither publish the images nor let the pipeline run is strictly worse than no gate, so it should report until the credential exists.

strict decides whether a failure is fatal, false from the release pipeline and true on manual dispatch:

      - name: Ensure Docker Hub repositories are public
        id: visibility
        continue-on-error: ${{ !inputs.strict }}
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_REPO_ADMIN_TOKEN || secrets.DOCKERHUB_IMAGE_PUSH_TOKEN }}
        run: ./scripts/ensure-dockerhub-public.sh

The rest follows from that: the workflow prefers a new optional DOCKERHUB_REPO_ADMIN_TOKEN (an organization access token with repo:admin) and falls back to the push token, a failed check raises a workflow warning, and the script names each unfixed image in the job summary with the reason, calling a 403 what it is rather than a generic HTTP error.

### Images still not public

- `lerianstudio/midaz-tracer`: still private: the Docker Hub token lacks repo:admin (HTTP 403)

Follow-up to actually publish the images

This PR unblocks releases; it does not make the three v4 images public, because no credential in CI can. Someone with owner access has to either flip midaz-tracer, midaz-tracer-migrations and midaz-ledger-migrations in the Docker Hub UI, or create an organization access token with repo:admin, store it as DOCKERHUB_REPO_ADMIN_TOKEN, and dispatch Docker Hub Visibility from develop. Once that secret exists, strict: true in release.yml turns this back into a hard gate so no future image ships private.

Type of Change

ci: CI pipeline or workflow changes

Breaking Changes

None.

Testing

actionlint and shellcheck clean. The script was re-run against a stubbed Docker Hub reproducing the exact production failure (PATCH → 403 on two images, success on a third, one already public): it reports each 403 as a missing repo:admin, writes the summary above, and exits 1; the all-public path exits 0 and writes no summary.

Related Issues

Follow-up to #2303. Unblocks the midaz v4 Helm work in LerianStudio/helm#1838.

The first release run after the gate landed failed: Docker Hub answers 403 on PATCH /repositories/<repo>/ because DOCKERHUB_IMAGE_PUSH_TOKEN can push tags but not change repository settings, so the job could neither publish the three private images nor let the pipeline run. Make the gate report instead of block until the credential exists: a strict input (false from the release pipeline, true on manual dispatch) decides whether a failure fails the job, the step emits a warning and a job summary naming every image left private, and the workflow now prefers DOCKERHUB_REPO_ADMIN_TOKEN, an organization access token with repo:admin, falling back to the push token. Flipping strict to true once that secret exists turns this back into a real gate. Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>

lerian-studio · 2026-08-06T07:44:55Z

⚠️ Lerian Library Version Check — review needed

Library	Current	Latest	Status
`lib-auth/v3`	`v3.3.0`	`v3.3.0`	✅ Current
`lib-commons/v6`	`v6.7.0`	`v6.7.0`	✅ Current
`lib-observability/v2`	`v2.1.1`	`v2.1.1`	✅ Current
`lib-service-discovery`	`v1.1.0`	`v1.1.0`	✅ Current
`lib-streaming/v2`	`v2.0.0`	skipped	⏭️ Skipped — ignore file, expires 2026-08-17 · why?

✅ 4 current · 🔴 0 needs update · 🕒 0 in grace · ⏭️ 1 skipped · ⚠️ 0 unknown

coderabbitai · 2026-08-06T07:45:05Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: b74574a7-d74f-4929-9bc9-42425906e5a5

📥 Commits

Reviewing files that changed from the base of the PR and between ef7aa0d and 69b4b98.

📒 Files selected for processing (1)

.github/workflows/dockerhub-visibility.yml

📝 Walkthrough

Walkthrough

The pull request adds configurable Docker Hub visibility enforcement, repository-admin token support, and unresolved-repository reporting. The release workflow runs the visibility check in non-strict mode.

Changes

Docker Hub visibility

Layer / File(s)	Summary
Visibility failure collection `scripts/ensure-dockerhub-public.sh`	The script requires `repo:admin` credentials for visibility changes. It collects unresolved repositories, reports authorization failures, and writes an optional GitHub step summary.
Reusable visibility workflow `.github/workflows/dockerhub-visibility.yml`	The workflow adds `strict` inputs and an optional repository-admin token. It selects the admin token when available and reports failed non-strict updates.
Release workflow integration `.github/workflows/release.yml`	The release workflow runs the visibility check with `strict: false` and passes the repository-admin token.

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseWorkflow
  participant DockerHubVisibilityWorkflow
  participant EnsureDockerHubPublic
  participant DockerHub
  ReleaseWorkflow->>DockerHubVisibilityWorkflow: Start pre-release check with strict=false
  DockerHubVisibilityWorkflow->>EnsureDockerHubPublic: Run with repository-admin token
  EnsureDockerHubPublic->>DockerHub: Create or update repository visibility
  DockerHub-->>EnsureDockerHubPublic: Return operation result
  EnsureDockerHubPublic-->>DockerHubVisibilityWorkflow: Return status and unresolved repositories
  DockerHubVisibilityWorkflow-->>ReleaseWorkflow: Continue release or report warning

Possibly related PRs

LerianStudio/midaz#2303: Extends the same Docker Hub visibility workflow, release integration, and visibility script.

✨ Finishing Touches

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch ci/dockerhub-visibility-nonblocking

_{Comment @coderabbitai help to get the list of available commands.}

lerian-studio · 2026-08-06T07:45:49Z

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

_{🔍 View workflow run}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/dockerhub-visibility.yml:
- Around line 63-67: Update the “Warn that images are not public” step condition
to use the explicit non-cancelled check together with steps.visibility.outcome
== 'failure', so it runs after strict failures while still appearing for masked
non-strict failures.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: f201f8bb-d7ba-445c-af6b-cc88c388c73a

📥 Commits

Reviewing files that changed from the base of the PR and between 18876ad and ef7aa0d.

📒 Files selected for processing (3)

.github/workflows/dockerhub-visibility.yml
.github/workflows/release.yml
scripts/ensure-dockerhub-public.sh

Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>

github-actions · 2026-08-06T08:12:47Z

Ungoliant Release Diff — Executed

The full chaos/fuzz analysis flow ran for this release.

Field	Value
outcome	`executed`
app	`midaz`
version	`v4.0.0-beta.25`
target_env	`chaos-dev-st`
risk_level	`medium`
k6 smoke scenarios	`5`
chaos experiments	`1`
schema	`release-plan`
run_id	`release-c7fda64ba04acceb`

Workflow run

fredcamaral requested review from a team as code owners August 6, 2026 07:44

blacksmith-sh Bot mentioned this pull request Aug 6, 2026

feat(midaz): add unified ledger config (CRM/Fees/KMS/tracer) and tracer templates LerianStudio/helm#1838

Merged

lerian-studio assigned fredcamaral Aug 6, 2026

lerian-studio added size/S PR changes 50-199 lines area: ci/cd GitHub Actions workflows and release configuration area: scripts Build and tooling scripts labels Aug 6, 2026

coderabbitai Bot requested changes Aug 6, 2026

View reviewed changes

Comment thread .github/workflows/dockerhub-visibility.yml

ci(workflows): warn on visibility failure in strict mode too 👷

69b4b98

Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>

coderabbitai Bot approved these changes Aug 6, 2026

View reviewed changes

fredcamaral merged commit 1325488 into develop Aug 6, 2026
31 checks passed

fredcamaral deleted the ci/dockerhub-visibility-nonblocking branch August 6, 2026 07:53

Navigation Menu

Uh oh!

ci(scripts): stop the visibility gate from blocking every release - #2304

ci(scripts): stop the visibility gate from blocking every release#2304
fredcamaral merged 2 commits into
developfrom
ci/dockerhub-visibility-nonblocking

fredcamaral commented Aug 6, 2026

Uh oh!

lerian-studio commented Aug 6, 2026

Uh oh!

coderabbitai Bot commented Aug 6, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

lerian-studio commented Aug 6, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

fredcamaral commented Aug 6, 2026

Description

Follow-up to actually publish the images

Type of Change

Breaking Changes

Testing

Related Issues

Uh oh!

lerian-studio commented Aug 6, 2026

⚠️ Lerian Library Version Check — review needed

Uh oh!

coderabbitai Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

lerian-studio commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 6, 2026

Ungoliant Release Diff — Executed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Aug 6, 2026 •

edited

Loading

lerian-studio commented Aug 6, 2026 •

edited

Loading