Skip to content

Use staging token directly for production image copy source #757

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
justin808 merged 1 commit into from
Jun 2, 2026
+8 −9
Merged

Use staging token directly for production image copy source #757

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 8 additions & 9 deletions .github/workflows/cpflow-promote-staging-to-production.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -381,21 +381,20 @@ jobs:
production_image="${PRODUCTION_APP_NAME}:$((latest_number + 1))_${staging_commit}"
source_image_ref="${CPLN_ORG_STAGING}.registry.cpln.io/${STAGING_IMAGE}"

upstream_profile="upstream-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
cleanup_upstream_profile() {
cpln profile delete "${upstream_profile}" >/dev/null 2>&1 || true
docker_config_dir="$(mktemp -d)"
cleanup_copy_credentials() {
rm -rf "${docker_config_dir}"
}
trap cleanup_upstream_profile EXIT
trap cleanup_copy_credentials EXIT

cleanup_upstream_profile
CPLN_TOKEN="${CPLN_TOKEN_STAGING}" cpln profile create "${upstream_profile}" >/dev/null
CPLN_PROFILE="${upstream_profile}" cpln image docker-login --org "${CPLN_ORG_STAGING}" >/dev/null
export DOCKER_CONFIG="${docker_config_dir}"

@claude claude Bot Jun 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DOCKER_CONFIG is exported for the whole step, so any Docker commands that run after the loop (e.g. in the same run: block if code is added later) will also use the temp dir — which will be cleaned up on EXIT. This is intentional and correct for isolation; just worth a comment so future editors don't wonder why the env var is set here instead of inline on each docker call.


copy_status=1
for attempt in $(seq 1 "${copy_image_attempts}"); do
if CPLN_PROFILE="${upstream_profile}" docker manifest inspect "${source_image_ref}" >/dev/null &&
if CPLN_TOKEN="${CPLN_TOKEN_STAGING}" cpln image docker-login --org "${CPLN_ORG_STAGING}" >/dev/null &&

@claude claude Bot Jun 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-running docker-login on every retry is safe (and refreshes credentials for long retry sequences), but it means copy_status=$? can capture a docker-login exit code rather than a copy exit code when login itself fails. The warning message will still say "Image copy attempt … failed" even if the real problem was authentication. Consider logging which step failed for easier diagnosis:

Suggested change
if CPLN_TOKEN="${CPLN_TOKEN_STAGING}" cpln image docker-login --org "${CPLN_ORG_STAGING}" >/dev/null &&
if CPLN_TOKEN="${CPLN_TOKEN_STAGING}" cpln image docker-login --org "${CPLN_ORG_STAGING}" >/dev/null 2>&1 \
|| { echo "::warning::docker-login to staging failed on attempt ${attempt}"; false; }; then
if docker manifest inspect "${source_image_ref}" >/dev/null &&

Or at minimum, keep the current structure but drop the >/dev/null on docker-login stderr so auth errors surface directly in the log.

docker manifest inspect "${source_image_ref}" >/dev/null &&
CPLN_TOKEN="${CPLN_TOKEN_STAGING}" \
cpln image copy "${STAGING_IMAGE}" \
--profile "${upstream_profile}" \
--org "${CPLN_ORG_STAGING}" \
--to-profile default \
--to-org "${CPLN_ORG_PRODUCTION}" \
Expand Down
Loading