From 8d20b37a000d6a34cd12281af122dc023b5e6bcd Mon Sep 17 00:00:00 2001 From: Pavel Strunkin Date: Sat, 24 Oct 2026 12:01:59 +0300 Subject: [PATCH] ci(docker): check out release tags explicitly and drop token persistence - workflow_dispatch checks out refs/tags/, so a branch with the same name can't be published under a release version - persist-credentials: false keeps GITHUB_TOKEN out of .git/config, which is part of the build context - permissions: contents: read; pushes use the Docker Hub secrets Addresses CodeRabbit review on backend#412. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/docker.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 0dbff55a..343ce6e4 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -26,6 +26,10 @@ on: description: Existing tag to publish, e.g. api-v5.7.0 or migration-v5.5.0 required: true +# GITHUB_TOKEN is only used to check out the code; image pushes use the Docker Hub secrets +permissions: + contents: read + jobs: docker: runs-on: ubuntu-22.04 @@ -60,7 +64,10 @@ jobs: - uses: actions/checkout@v4 if: steps.version.outputs.build == 'true' with: - ref: ${{ inputs.tag || github.ref }} + # a manual run checks out the tag itself, never a branch with the same name + ref: ${{ inputs.tag && format('refs/tags/{0}', inputs.tag) || github.ref }} + # keep the token out of .git/config, which is part of the build context + persist-credentials: false - name: Set up QEMU if: steps.version.outputs.build == 'true'