ci: authenticate Docker Hub pulls in the integration-test matrix - #384
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Improves CI reliability for the integration-test matrix by avoiding anonymous Docker Hub rate limits and by making database-image pull failures easier to diagnose before docker compose up runs.
Changes:
- Adds a conditional Docker Hub login step in the integration-test job (skipped when the secret is unavailable, e.g., fork PRs).
- Pre-pulls the matrix database service image (
db) when present in the selected compose file, so pull errors appear directly in logs.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+607
to
+612
| compose_file="./tests_integration/docker-compose-${{ matrix.dbtype }}.yml" | ||
| if docker compose -f "$compose_file" config --services | grep -qx db; then | ||
| docker compose -f "$compose_file" pull db | ||
| else | ||
| echo "No 'db' service in $compose_file (${{ matrix.dbtype }} runs in-process) -- nothing to pull." | ||
| fi |
`test (cockroachdb)` began failing on PR #378 with the app never starting: the job died during `db Pulling`, before pytest ran. The same commit range passed the same job 24 minutes earlier, the other three database legs pass with identical application code, and the image pulls fine locally -- so the failure tracks the runner's Docker Hub quota, not the commit under test. Anonymous pulls are rate-limited per source IP and GitHub's hosted runners share theirs across the fleet, so any leg can start failing for reasons unrelated to the change being tested. Log in with the credentials the publish job already uses to get the authenticated quota. The step is skipped when the secret is unavailable (fork PRs), leaving those runs exactly as they are rather than failing on a missing secret. The token is hoisted to a job-level env var because the `secrets` context is not available in a step-level `if`. Also pull the database image in its own step. compose-action reports only "Docker Compose command failed with exit code 1" and echoes the pull progress lines, swallowing the message that says why -- diagnosing this failure meant reasoning from which legs passed, because the log never contained the error. A separate pull puts it in the log. sqlite has no `db` service, so the guard reads the compose file's service list rather than matching on the matrix name. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
sherrmann
force-pushed
the
ci/authenticate-dockerhub-pulls
branch
from
August 8, 2026 09:03
328bd5a to
2722497
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
test (cockroachdb)started failing on #378 with the application never starting — the job dies duringdb Pulling, so pytest never runs.Why this is not the code under test
test (cockroachdb)24 minutes earlier (run 31247287322)postgres,mariadbandsqliteall pass with identical application codedb Pulling, before the app container startscockroachdb/cockroach:v23.1.2pulls fine locallyThat leaves the runner's Docker Hub quota. Anonymous pulls are rate-limited per source IP and GitHub's hosted runners share theirs across the fleet, so any matrix leg can start failing for reasons that have nothing to do with the commit being tested. cockroachdb is the leg that notices first — it is by far the largest of the four images.
Change
Log in to Docker Hub before the integration tests. Reuses the credentials the publish job already uses (
secrets.REMOTE_REGISTRY_PASSWORD), which lifts the pull limit to the authenticated quota. The step is skipped when the secret is unavailable — fork PRs — so those runs behave exactly as they do today instead of failing on a missing secret.Pull the database image in its own step.
hoverkraft-tech/compose-actionreports onlyError: Docker Compose command failed with exit code 1and echoes the pull progress lines, swallowing the message that says why. Diagnosing this failure meant reasoning from which legs passed, because the log never contained the actual error. An explicit pull puts it in the log and leaves nothing forupto fetch. The sqlite leg has nodbservice, so the guard reads the compose file's own service list rather than matching on the matrix name.Verification
This PR's own
test (cockroachdb)job is the test: it is the job that has been failing.Locally confirmed: the workflow YAML parses and the
testjob's step list is as intended; the service-list guard resolves to a pull for cockroachdb/postgres/mariadb and to a skip for sqlite.Unblocks #378 and #383.
🤖 Generated with Claude Code