From 4cf57997de14f9cc6c3cd3c590eccab255153991 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Mar 2026 18:12:57 +0000 Subject: [PATCH 1/3] ci: push authzcache image to dockerhub under descope/authzcache Enable DockerHub publishing in the pack job by passing credentials (DOCKERHUB_USERNAME / DOCKERHUB_TOKEN secrets) and setting enable_dockerhub=true. The same tag strategy used for GHCR is applied to DockerHub via the existing docker-metadata action. https://claude.ai/code/session_01AFS1pbi1rh4oqmJMQYfdnY --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index be9c0f45..01247773 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -87,6 +87,10 @@ jobs: - name: Pack and Upload uses: ./.github/actions/pack + with: + enable_dockerhub: "true" + dockerhub_username: ${{ secrets.DOCKERHUB_USERNAME }} + dockerhub_token: ${{ secrets.DOCKERHUB_TOKEN }} env: RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }} RELEASE_APP_PEM: ${{ secrets.RELEASE_APP_PEM }} From da654c295add0233730366763657ef7e798f0bd0 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Mar 2026 18:21:21 +0000 Subject: [PATCH 2/3] ci: build on any branch, push only on main or workflow_dispatch - Add workflow_dispatch trigger to allow manual runs - Gate the pack job behind main branch or manual trigger so images are only published from main or on-demand https://claude.ai/code/session_01AFS1pbi1rh4oqmJMQYfdnY --- .github/workflows/ci.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 01247773..7dcf959d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,6 +1,8 @@ name: CI -on: push +on: + push: + workflow_dispatch: env: DATABASE_PASSWORD: passwordless @@ -76,6 +78,7 @@ jobs: name: Pack and Upload runs-on: ubuntu-latest needs: [build, lint, test, security] + if: github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch' permissions: contents: read packages: write From a9f6262fd9d77c52d7372599c1a1adefa80189fd Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 11 Mar 2026 08:28:48 +0000 Subject: [PATCH 3/3] ci: run docker build on every PR, push only on main or workflow_dispatch - Add push_image input to pack action (default true) - Gate registry logins, Trivy scan, and Attest behind push_image - docker/build-push-action uses push: false on non-main branches - ci.yml passes push_image based on branch/event; pack job always runs https://claude.ai/code/session_01AFS1pbi1rh4oqmJMQYfdnY --- .github/actions/pack/action.yml | 19 +++++++++++++++---- .github/workflows/ci.yml | 2 +- 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/.github/actions/pack/action.yml b/.github/actions/pack/action.yml index dacfe2a8..0e5bb6d8 100644 --- a/.github/actions/pack/action.yml +++ b/.github/actions/pack/action.yml @@ -47,6 +47,10 @@ inputs: description: "Enable DockerHub publishing" required: false default: "false" + push_image: + description: "Push the built image to registries (set to false for build-only validation)" + required: false + default: "true" runs: using: "composite" @@ -71,6 +75,7 @@ runs: echo dockerfile=${DOCKERFILE_PATH} >> ${GITHUB_OUTPUT} - name: Login to GHCR + if: ${{ inputs.push_image == 'true' }} uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: registry: ghcr.io @@ -78,6 +83,7 @@ runs: password: ${{ inputs.action_token}} - name: Configure AWS Credentials + if: ${{ inputs.push_image == 'true' }} uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 with: aws-region: us-east-1 @@ -86,10 +92,11 @@ runs: - name: Login to Amazon ECR id: login-ecr + if: ${{ inputs.push_image == 'true' }} uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1 - name: Login to Docker Hub - if: ${{ inputs.enable_dockerhub == 'true' && inputs.dockerhub_username && inputs.dockerhub_token }} + if: ${{ inputs.push_image == 'true' && inputs.enable_dockerhub == 'true' && inputs.dockerhub_username && inputs.dockerhub_token }} uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: registry: docker.io @@ -107,7 +114,7 @@ runs: - name: Extract metadata for DockerHub id: meta-dockerhub - if: ${{ inputs.enable_dockerhub == 'true' }} + if: ${{ inputs.push_image == 'true' && inputs.enable_dockerhub == 'true' }} uses: ./.github/actions/docker-metadata with: cache: "false" @@ -118,12 +125,13 @@ runs: with: version: latest cache-binary: false + - name: Combine tags for all registries id: combine-tags shell: bash run: | TAGS="${{ steps.meta.outputs.tags }}" - if [[ "${{ inputs.enable_dockerhub }}" == "true" ]]; then + if [[ "${{ inputs.push_image }}" == "true" && "${{ inputs.enable_dockerhub }}" == "true" ]]; then DOCKERHUB_TAGS="${{ steps.meta-dockerhub.outputs.tags }}" if [[ -n "$DOCKERHUB_TAGS" ]]; then TAGS="$TAGS"$'\n'"$DOCKERHUB_TAGS" @@ -139,7 +147,7 @@ runs: with: platforms: ${{ inputs.platforms }} context: . - push: true + push: ${{ inputs.push_image == 'true' }} sbom: true provenance: mode=max file: ${{ steps.setup_build_args.outputs.dockerfile }} @@ -159,12 +167,15 @@ runs: cache-to: type=gha,mode=max - name: Run Trivy vulnerability scanner + if: ${{ inputs.push_image == 'true' }} uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0 with: image-ref: ghcr.io/descope/${{steps.setup_build_args.outputs.repo_name}}@${{steps.push.outputs.digest}} format: "table" exit-code: ${{ inputs.fail_on_vulnerabilities == 'true' && '1' || '0' }} + - name: Attest + if: ${{ inputs.push_image == 'true' }} uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4 id: attest with: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7dcf959d..ff986ede 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -78,7 +78,6 @@ jobs: name: Pack and Upload runs-on: ubuntu-latest needs: [build, lint, test, security] - if: github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch' permissions: contents: read packages: write @@ -91,6 +90,7 @@ jobs: - name: Pack and Upload uses: ./.github/actions/pack with: + push_image: ${{ github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch' }} enable_dockerhub: "true" dockerhub_username: ${{ secrets.DOCKERHUB_USERNAME }} dockerhub_token: ${{ secrets.DOCKERHUB_TOKEN }}