From 7d001bd23bee1ea4c616bb90edc71bb5fa1892ba Mon Sep 17 00:00:00 2001
From: darksworm <9987548+darksworm@users.noreply.github.com>
Date: Fri, 25 Sep 2026 10:39:24 +0200
Subject: [PATCH] ci: added publishing to dockerhub

---
 .github/workflows/publish-image.yml    | 15 ++++++++++++++-
 .github/workflows/release-pipeline.yml |  8 ++++----
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index 5de515b..df81fea 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -10,6 +10,11 @@ on:
         description: "Tag to build and publish the image for"
         required: true
         type: string
+    secrets:
+      DOCKERHUB_USERNAME:
+        required: true
+      DOCKERHUB_PASSWORD:
+        required: true
   workflow_dispatch:
     inputs:
       tag:
@@ -47,12 +52,20 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
       - name: Image metadata
         id: meta
         uses: docker/metadata-action@v6
         with:
           context: git
-          images: ghcr.io/darksworm/doormouse
+          images: |
+            ghcr.io/darksworm/doormouse
+            ${{ secrets.DOCKERHUB_USERNAME }}/doormouse
           tags: |
             type=semver,pattern={{version}},value=${{ inputs.tag }}
             type=semver,pattern={{major}}.{{minor}},value=${{ inputs.tag }}
diff --git a/.github/workflows/release-pipeline.yml b/.github/workflows/release-pipeline.yml
index ac3b20b..45bb0f9 100644
--- a/.github/workflows/release-pipeline.yml
+++ b/.github/workflows/release-pipeline.yml
@@ -39,10 +39,7 @@ jobs:
     if: ${{ needs.release-please.outputs.release_created == 'true' }}
     uses: ./.github/workflows/test.yml
 
-  # No `secrets: inherit`: the called workflow needs nothing beyond
-  # GITHUB_TOKEN, which reusable workflows always get, and inheriting would
-  # hand it RELEASE_PLEASE_TOKEN for no reason.
-  #
+  # Pass only the Docker Hub credentials required by the reusable workflow.
   # If this job fails, the tag and the draft release already exist, so a later
   # push to main will not retry it — release-please only reports
   # release_created once. Re-run the publish-image workflow directly instead; it
@@ -53,3 +50,6 @@ jobs:
     uses: ./.github/workflows/publish-image.yml
     with:
       tag: ${{ needs.release-please.outputs.tag_name }}
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_PASSWORD }}