Skip to content

Docker: Mirror images to GitHub Container Registry #3098

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
VietND96 merged 6 commits into from
Apr 9, 2026
Merged

Docker: Mirror images to GitHub Container Registry #3098

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
6838346
Docker: Mirror images to GitHub Container Registry
VietND96 Mar 24, 2026
82175dc
Fix lint
VietND96 Mar 24, 2026
ea45e63
Lower case in namespace
VietND96 Mar 24, 2026
5985419
Get username login GHCR from secrets
VietND96 Mar 25, 2026
a87f7e5
Merge branch 'trunk' into deploy-ghcr
VietND96 Mar 29, 2026
6306dfc
Merge branch 'trunk' into deploy-ghcr
VietND96 Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,9 @@ jobs:
env:
DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
DOCKER_PASSWORD: ${{secrets.DOCKER_PASSWORD}}
- name: Login GitHub Container Registry
if: github.event.inputs.skip-build-push-image != 'true'
run: echo "${{ secrets.SELENIUM_CI_TOKEN }}" | docker login ghcr.io -u "${{ github.repository_owner }}" --password-stdin
Comment thread
qodo-code-review[bot] marked this conversation as resolved.
Outdated
- name: Deploy new images
if: github.event.inputs.skip-build-push-image != 'true'
uses: nick-invision/retry@master
Expand All @@ -153,6 +156,14 @@ jobs:
max_attempts: 5
retry_wait_seconds: 300
command: VERSION="${GRID_VERSION}" BUILD_DATE=${BUILD_DATE} make release
- name: Mirror versioned images to GHCR
if: github.event.inputs.skip-build-push-image != 'true'
uses: nick-invision/retry@master
with:
timeout_minutes: 30
max_attempts: 5
retry_wait_seconds: 300
command: GHCR_NAMESPACE="ghcr.io/${{ github.repository_owner }}" VERSION="${GRID_VERSION}" BUILD_DATE=${BUILD_DATE} make release_ghcr
Copy link
Copy Markdown
Contributor

@qodo-code-review qodo-code-review Bot Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

2. build_date unquoted in command 📘 Rule violation ⛯ Reliability

The workflow passes BUILD_DATE=${BUILD_DATE} without quotes, which can cause
word-splitting/globbing if the value ever contains whitespace or special characters. This violates
the requirement for robust shell quoting in scripts/configured commands.
Agent Prompt 
## Issue description
A workflow command assigns `BUILD_DATE=${BUILD_DATE}` without quotes, which is not robust against whitespace/globbing.

## Issue Context
This is part of the GHCR mirroring step; failures here can lead to incomplete releases.

## Fix Focus Areas
- .github/workflows/deploy.yml[166-166]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

- name: Tag images as latest
if: github.event.inputs.skip-build-push-image != 'true'
run: VERSION="${GRID_VERSION}" BUILD_DATE=${BUILD_DATE} make tag_latest
Expand All @@ -164,6 +175,14 @@ jobs:
max_attempts: 5
retry_wait_seconds: 300
command: VERSION="${GRID_VERSION}" BUILD_DATE=${BUILD_DATE} make release_latest
- name: Mirror latest images to GHCR
if: github.event.inputs.skip-build-push-image != 'true'
uses: nick-invision/retry@master
with:
timeout_minutes: 20
max_attempts: 5
retry_wait_seconds: 300
command: GHCR_NAMESPACE="ghcr.io/${{ github.repository_owner }}" VERSION="${GRID_VERSION}" BUILD_DATE=${BUILD_DATE} make release_ghcr_latest
- name: Update package versions
run: make update_browser_versions_matrix
# make generate_latest_sbom
Expand All @@ -176,6 +195,14 @@ jobs:
max_attempts: 5
retry_wait_seconds: 300
command: VERSION="${GRID_VERSION}" BUILD_DATE=${BUILD_DATE} PUSH_IMAGE=true make tag_and_push_browser_images
- name: Mirror browser images to GHCR
if: github.event.inputs.skip-build-push-image != 'true'
uses: nick-invision/retry@master
with:
timeout_minutes: 30
max_attempts: 5
retry_wait_seconds: 300
command: GHCR_NAMESPACE="ghcr.io/${{ github.repository_owner }}" VERSION="${GRID_VERSION}" BUILD_DATE=${BUILD_DATE} make tag_and_push_browser_images_ghcr
- name: Delete previous nightly tag & release if any
uses: dev-drprasad/delete-tag-and-release@master
with:
Expand Down
9 changes: 9 additions & 0 deletions .github/workflows/nightly.yml
View file
Open in desktop
Copy link
Copy Markdown

@KyleAure KyleAure Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If space is a concern on ghcr, perhaps we should skip uploading nightly builds to ghcri.

Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,8 @@ jobs:
env:
DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
DOCKER_PASSWORD: ${{secrets.DOCKER_PASSWORD}}
- name: Login GitHub Container Registry
run: echo "${{ secrets.SELENIUM_CI_TOKEN }}" | docker login ghcr.io -u "${{ github.repository_owner }}" --password-stdin
- name: Tag images as nightly
run: VERSION="${GRID_VERSION}" BUILD_DATE=${BUILD_DATE} make tag_nightly
- name: Deploy nightly tag
Expand All @@ -106,6 +108,13 @@ jobs:
max_attempts: 3
retry_wait_seconds: 120
command: VERSION="${GRID_VERSION}" BUILD_DATE=${BUILD_DATE} make release_nightly
- name: Mirror nightly images to GHCR
uses: nick-invision/retry@master
with:
timeout_minutes: 20
max_attempts: 3
retry_wait_seconds: 120
command: GHCR_NAMESPACE="ghcr.io/${{ github.repository_owner }}" VERSION="${GRID_VERSION}" BUILD_DATE=${BUILD_DATE} make release_ghcr_nightly
# - name: Update package versions
# run: make generate_nightly_sbom
- name: Get current latest tag
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/release-chrome-for-testing-versions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,9 @@ jobs:
env:
DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
DOCKER_PASSWORD: ${{secrets.DOCKER_PASSWORD}}
- name: Login GitHub Container Registry
if: env.PUSH_IMAGE == 'true'
run: echo "${{ secrets.SELENIUM_CI_TOKEN }}" | docker login ghcr.io -u "${{ github.repository_owner }}" --password-stdin
- name: Build images with Grid core ${{ env.GRID_VERSION }} and ${{ env.BROWSER_NAME }} v${{ env.BROWSER_VERSION }}
uses: nick-invision/retry@master
with:
Expand Down Expand Up @@ -148,6 +151,9 @@ jobs:
if: env.PUSH_IMAGE == 'true'
run: |
./tests/build-backward-compatible/bootstrap.sh ${GRID_VERSION} ${BROWSER_VERSION} ${BROWSER_NAME} ${REUSE_BASE} true true
- name: Mirror images to GHCR
if: env.PUSH_IMAGE == 'true'
run: GHCR_NAMESPACE="ghcr.io/${{ github.repository_owner }}" BROWSER_NAME="${BROWSER_NAME}" make mirror_browser_images_ghcr
- name: Upload changelog
if: always()
uses: actions/upload-artifact@main
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/release-chrome-versions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,9 @@ jobs:
env:
DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
DOCKER_PASSWORD: ${{secrets.DOCKER_PASSWORD}}
- name: Login GitHub Container Registry
if: env.PUSH_IMAGE == 'true'
run: echo "${{ secrets.SELENIUM_CI_TOKEN }}" | docker login ghcr.io -u "${{ github.repository_owner }}" --password-stdin
- name: Build images with Grid core ${{ env.GRID_VERSION }} and ${{ env.BROWSER_NAME }} v${{ env.BROWSER_VERSION }}
uses: nick-invision/retry@master
with:
Expand Down Expand Up @@ -148,6 +151,9 @@ jobs:
if: env.PUSH_IMAGE == 'true'
run: |
./tests/build-backward-compatible/bootstrap.sh ${GRID_VERSION} ${BROWSER_VERSION} ${BROWSER_NAME} ${REUSE_BASE} true true
- name: Mirror images to GHCR
if: env.PUSH_IMAGE == 'true'
run: GHCR_NAMESPACE="ghcr.io/${{ github.repository_owner }}" BROWSER_NAME="${BROWSER_NAME}" make mirror_browser_images_ghcr
- name: Upload changelog
if: always()
uses: actions/upload-artifact@main
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/release-edge-versions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,9 @@ jobs:
env:
DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
DOCKER_PASSWORD: ${{secrets.DOCKER_PASSWORD}}
- name: Login GitHub Container Registry
if: env.PUSH_IMAGE == 'true'
run: echo "${{ secrets.SELENIUM_CI_TOKEN }}" | docker login ghcr.io -u "${{ github.repository_owner }}" --password-stdin
- name: Build images with Grid core ${{ env.GRID_VERSION }} and ${{ env.BROWSER_NAME }} v${{ env.BROWSER_VERSION }}
uses: nick-invision/retry@master
with:
Expand Down Expand Up @@ -148,6 +151,9 @@ jobs:
if: env.PUSH_IMAGE == 'true'
run: |
./tests/build-backward-compatible/bootstrap.sh ${GRID_VERSION} ${BROWSER_VERSION} ${BROWSER_NAME} ${REUSE_BASE} true true
- name: Mirror images to GHCR
if: env.PUSH_IMAGE == 'true'
run: GHCR_NAMESPACE="ghcr.io/${{ github.repository_owner }}" BROWSER_NAME="${BROWSER_NAME}" make mirror_browser_images_ghcr
- name: Upload changelog
if: always()
uses: actions/upload-artifact@main
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/release-firefox-versions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,9 @@ jobs:
env:
DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
DOCKER_PASSWORD: ${{secrets.DOCKER_PASSWORD}}
- name: Login GitHub Container Registry
if: env.PUSH_IMAGE == 'true'
run: echo "${{ secrets.SELENIUM_CI_TOKEN }}" | docker login ghcr.io -u "${{ github.repository_owner }}" --password-stdin
- name: Build images with Grid core ${{ env.GRID_VERSION }} and ${{ env.BROWSER_NAME }} v${{ env.BROWSER_VERSION }}
uses: nick-invision/retry@master
with:
Expand Down Expand Up @@ -148,6 +151,9 @@ jobs:
if: env.PUSH_IMAGE == 'true'
run: |
./tests/build-backward-compatible/bootstrap.sh ${GRID_VERSION} ${BROWSER_VERSION} ${BROWSER_NAME} ${REUSE_BASE} true true
- name: Mirror images to GHCR
if: env.PUSH_IMAGE == 'true'
run: GHCR_NAMESPACE="ghcr.io/${{ github.repository_owner }}" BROWSER_NAME="${BROWSER_NAME}" make mirror_browser_images_ghcr
- name: Upload changelog
if: always()
uses: actions/upload-artifact@main
Expand Down
64 changes: 64 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ KEDA_BASED_NAME := $(or $(KEDA_BASED_NAME),$(KEDA_BASED_NAME),kedacore)
KEDA_BASED_TAG := $(or $(KEDA_BASED_TAG),$(KEDA_BASED_TAG),2.19.0)
TEST_PATCHED_KEDA := $(or $(TEST_PATCHED_KEDA),$(TEST_PATCHED_KEDA),false)
TRACING_EXPORTER_ENDPOINT := $(or $(TRACING_EXPORTER_ENDPOINT),$(TRACING_EXPORTER_ENDPOINT),http://\$$KUBERNETES_NODE_HOST_IP:4317)
GHCR_NAMESPACE := $(or $(GHCR_NAMESPACE),$(GHCR_NAMESPACE),ghcr.io/seleniumhq)
Copy link
Copy Markdown
Contributor

@qodo-code-review qodo-code-review Bot Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. ghcr_namespace defaults to seleniumhq 📎 Requirement gap ✓ Correctness

The GHCR namespace is set to ghcr.io/seleniumhq, but the compliance requirement specifies
publishing under ghcr.io/selenium/.... This can break the expected pull path and fails the
required registry naming scheme.
Agent Prompt 
## Issue description
The default GHCR namespace is `ghcr.io/seleniumhq`, but compliance requires images be published under `ghcr.io/selenium/...`.

## Issue Context
This PR introduces GHCR mirroring; the registry namespace must match the required org/prefix so users can pull images from the documented location.

## Fix Focus Areas
- Makefile[40-40]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


all: hub \
distributor \
Expand Down Expand Up @@ -468,6 +469,28 @@ tag_and_push_edge_images:
tag_and_push_firefox_images:
./tag_and_push_browser_images.sh $(VERSION) $(BUILD_DATE) $(NAMESPACE) $(PUSH_IMAGE) firefox $(RELEASE_OLD_VERSION)

tag_and_push_browser_images_ghcr:
for image in node-chrome standalone-chrome \
node-chromium standalone-chromium \
node-chrome-for-testing standalone-chrome-for-testing \
node-edge standalone-edge \
node-firefox standalone-firefox; do \
docker images --format "{{.Tag}}" "$(NAME)/$$image" | grep -v "^<none>$$" | while IFS= read -r tag; do \
docker buildx imagetools create \
--tag $(GHCR_NAMESPACE)/$$image:$$tag \
docker.io/$(NAME)/$$image:$$tag ; \
done ; \
done

mirror_browser_images_ghcr:
for image in node-$(BROWSER_NAME) standalone-$(BROWSER_NAME); do \
docker images --format "{{.Tag}}" "$(NAME)/$$image" | grep -v "^<none>$$" | while IFS= read -r tag; do \
docker buildx imagetools create \
--tag $(GHCR_NAMESPACE)/$$image:$$tag \
docker.io/$(NAME)/$$image:$$tag ; \
done ; \
done
Comment on lines +472 to +492
Copy link
Copy Markdown
Contributor

@qodo-code-review qodo-code-review Bot Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

4. Mirror can silently no-op 🐞 Bug ✓ Correctness

The new Makefile GHCR mirroring targets can exit successfully without mirroring anything when
docker images returns no tags, because the grep | while pipeline returns success even on empty
input.
Agent Prompt 
### Issue description
`tag_and_push_browser_images_ghcr` / `mirror_browser_images_ghcr` can succeed while mirroring nothing if no local tags are found for the images, due to pipeline exit status behavior.

### Issue Context
Current implementation:
- lists tags with `docker images --format "{{.Tag}}" "$(NAME)/$image"`
- filters with `grep -v "^<none>$"`
- iterates via `while read -r tag; do ...; done`
This pattern returns success even with zero tags.

### Fix Focus Areas
- Makefile[472-492]

### Suggested fix
Capture tags into a variable and explicitly error if empty, e.g.:

```make
mirror_browser_images_ghcr:
	for image in node-$(BROWSER_NAME) standalone-$(BROWSER_NAME); do \
	  tags="$$(docker images --format '{{.Tag}}' '$(NAME)/'$$image | grep -v '^<none>$$' || true)"; \
	  if [ -z "$$tags" ]; then \
	    echo "No local tags found for $(NAME)/$$image; cannot mirror" >&2; \
	    exit 1; \
	  fi; \
	  for tag in $$tags; do \
	    docker buildx imagetools create --tag $(GHCR_NAMESPACE)/$$image:$$tag docker.io/$(NAME)/$$image:$$tag; \
	  done; \
	done
```

Optionally add `set -e`/`pipefail` within the recipe to ensure failures propagate.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


tag_ffmpeg_latest:
docker tag $(NAME)/ffmpeg:$(FFMPEG_VERSION)-$(BUILD_DATE) $(NAME)/ffmpeg:latest
docker tag $(NAME)/ffmpeg:$(FFMPEG_VERSION)-$(BUILD_DATE) $(NAME)/ffmpeg:$(FFMPEG_VERSION)
Expand Down Expand Up @@ -537,6 +560,18 @@ release_latest:
docker push $(NAME)/standalone-all-browsers:latest
docker push $(NAME)/video:latest

release_ghcr_latest:
for image in base hub distributor router sessions session-queue event-bus \
node-base node-chrome node-chromium node-chrome-for-testing node-edge \
node-firefox node-docker node-kubernetes node-all-browsers \
standalone-chrome standalone-chromium standalone-chrome-for-testing \
standalone-edge standalone-firefox standalone-docker \
standalone-kubernetes standalone-all-browsers video; do \
docker buildx imagetools create \
--tag $(GHCR_NAMESPACE)/$$image:latest \
docker.io/$(NAME)/$$image:latest ; \
done

generate_latest_sbom:
NAME=$(NAME) FILTER_IMAGE_TAG=latest OUTPUT_FILE=$(SBOM_OUTPUT) ./generate_sbom.sh

Expand Down Expand Up @@ -600,6 +635,18 @@ release_nightly:
docker push $(NAME)/standalone-all-browsers:nightly
docker push $(NAME)/video:nightly

release_ghcr_nightly:
for image in base hub distributor router sessions session-queue event-bus \
node-base node-chrome node-chromium node-chrome-for-testing node-edge \
node-firefox node-docker node-kubernetes node-all-browsers \
standalone-chrome standalone-chromium standalone-chrome-for-testing \
standalone-edge standalone-firefox standalone-docker \
standalone-kubernetes standalone-all-browsers video; do \
docker buildx imagetools create \
--tag $(GHCR_NAMESPACE)/$$image:nightly \
docker.io/$(NAME)/$$image:nightly ; \
done

generate_nightly_sbom:
NAME=$(NAME) FILTER_IMAGE_TAG=nightly OUTPUT_FILE=$(SBOM_OUTPUT) ./generate_sbom.sh

Expand Down Expand Up @@ -800,6 +847,23 @@ release: tag_major_minor
docker push $(NAME)/standalone-all-browsers:$(MAJOR_MINOR_PATCH)
docker push $(NAME)/video:$(FFMPEG_TAG_VERSION)-$(BUILD_DATE)

release_ghcr:
for image in base hub distributor router sessions session-queue event-bus \
node-base node-chrome node-chromium node-chrome-for-testing node-edge \
node-firefox node-docker node-kubernetes node-all-browsers \
standalone-chrome standalone-chromium standalone-chrome-for-testing \
standalone-edge standalone-firefox standalone-docker \
standalone-kubernetes standalone-all-browsers; do \
for tag in $(TAG_VERSION) $(MAJOR) $(MAJOR).$(MINOR) $(MAJOR_MINOR_PATCH); do \
docker buildx imagetools create \
--tag $(GHCR_NAMESPACE)/$$image:$$tag \
docker.io/$(NAME)/$$image:$$tag ; \
done ; \
done
docker buildx imagetools create \
--tag $(GHCR_NAMESPACE)/video:$(FFMPEG_TAG_VERSION)-$(BUILD_DATE) \
docker.io/$(NAME)/video:$(FFMPEG_TAG_VERSION)-$(BUILD_DATE)

start_test_site:
@docker rm -f the-internet 2>/dev/null || true
@docker run --rm --name the-internet -d -p 5001:5000 ndviet/the-internet:latest
Expand Down
Loading