Repository navigation
Rust #325: publish native release candidates to GHCR without Docker Hub - #883
Merged
Merged
Conversation
The operator chose (October 30) to qualify native release candidates before Docker Hub credentials exist. A new plan job reads the tag: a native-X.Y.Z-rc.N candidate publishes to GHCR only, and skips the Docker Hub sign-in, push and attestation; any other version still requires both registries and fails closed without the Docker Hub credentials. The publish script refuses a non-candidate version that would skip Docker Hub, and any value other than true or false. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
check-native-release-tags.sh drove the publisher without the new PUBLISH_DOCKERHUB input, so it stopped at that refusal. It now passes the input explicitly and also checks that only a release candidate may skip Docker Hub and that the choice must be explicit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
12 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #325. Operator decision (October 30): qualify a native release candidate on GHCR now, and add Docker Hub later.
What changes
planjob. It reads the tag. Anative-X.Y.Z-rc.Ncandidate publishes to GHCR only, skipping the Docker Hub sign-in, the Docker Hub push name and the Docker Hub attestation. Any other version still publishes to both registries, and still fails closed while the Docker Hub credentials are absent. The job accepts onlynative-X.Y.Zornative-X.Y.Z-rc.N.native-release-publish.sh. It takesPUBLISH_DOCKERHUB(trueorfalse) and refuses:Otherwise, every registry check stays as before: tag absent before, index identical, exactly the smoked platform digests.
Environment.
dockerhub-nativenow exists with a main-only deployment branch policy and no secrets, as Security asked before any native publication. The Docker Hub repositorydurableworkflow/server-nativeand its scoped token are still to come.Checks
actionlintis clean.docker, the publish script:native-3.0.0-rc.1withfalseto GHCR only;native-3.0.0withfalse;native-3.0.0withtrueto both registries;trueto both registries;Next
After merge, tag
native-3.0.0-rc.1on main and dispatch this workflow. The resulting image is what the release-candidate performance qualification and installed acceptance run against.🤖 Generated with Claude Code