From 85f46b5fc5ddb80e77ebe84936820506ac678600 Mon Sep 17 00:00:00 2001 From: Jairo Llopis Date: Mon, 22 Jun 2026 11:52:09 +0100 Subject: [PATCH] ci: run build-test-push on all PRs and fix ghcr push auth Fork PRs previously skipped the build-test-push job entirely, preventing contributors from getting build and test feedback. The GHCR push step used || between independent secrets: BOT_TOKEN || GITHUB_TOKEN and BOT_LOGIN || repository_owner. When only one BOT_* secret was set, credentials became a mismatched pair, causing a denied: denied authentication failure from ghcr.io. Changes: - Remove same-repo restriction from job condition so all PRs run the pipeline. - Use && to ensure both BOT_TOKEN and BOT_LOGIN must exist together to be used; otherwise fall back to the always- available GITHUB_TOKEN + github.repository_owner pair. - Expose BOT_TOKEN and BOT_LOGIN as env vars so they can be evaluated in the if: condition. - Allow GHCR push on fork PRs when bot credentials are available; skip only when GITHUB_TOKEN would be read-only (fork PR without BOT_TOKEN/BOT_LOGIN). - Use github.repository_owner as fallback username instead of github.actor to avoid confusion in org fork scenarios. --- .github/workflows/ci.yaml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 3ffd4ea..6112667 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -25,7 +25,7 @@ jobs: - uses: pre-commit/action@v1.0.1 build-test-push: - if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) + if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || github.event_name == 'pull_request' runs-on: ubuntu-latest needs: pre-commit permissions: @@ -62,6 +62,8 @@ jobs: # Github does not allow evaluating a secret in an if condition, so we need to set them as environment variables DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} DOCKERHUB_LOGIN: ${{ secrets.DOCKERHUB_LOGIN }} + BOT_TOKEN: ${{ secrets.BOT_TOKEN }} + BOT_LOGIN: ${{ secrets.BOT_LOGIN }} steps: # Image repo names have to be lowercase. - name: Lowercase image repository name @@ -98,8 +100,9 @@ jobs: REGISTRY_USERNAME: ${{ env.DOCKERHUB_LOGIN }} run: ./hooks/push - name: Push Docker Image to GitHub Registry + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository || env.BOT_TOKEN && env.BOT_LOGIN env: REGISTRY_HOST: ghcr.io - REGISTRY_TOKEN: ${{ secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }} - REGISTRY_USERNAME: ${{ secrets.BOT_LOGIN || github.repository_owner }} + REGISTRY_TOKEN: ${{ secrets.BOT_LOGIN && secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }} + REGISTRY_USERNAME: ${{ secrets.BOT_TOKEN && secrets.BOT_LOGIN || github.repository_owner }} run: ./hooks/push