Update registry credentials and secret references in CI/CD pipeline - #83
Conversation
📝 WalkthroughWalkthroughThe CI/CD workflow's container registry authentication credentials were updated to use GitHub's built-in actor and token instead of external S9 registry secrets. Both secret source mappings were replaced while maintaining the same credential structure for downstream pipeline consumption. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/ui-cicd.yml:
- Around line 34-35: Replace the incorrect secrets reference and fix the Docker
Hub auth: change the registry-username value from the invalid
secrets.github.actor to the workflow context github.actor, and stop using
secrets.GITHUB_TOKEN for docker.io auth; instead wire in repository secrets for
Docker Hub (e.g., use secrets.DOCKERHUB_USERNAME and secrets.DOCKERHUB_PAT as
the registry-username and registry-password) or alternatively change the target
registry to ghcr.io and keep GITHUB_TOKEN for auth; update the keys referenced
in the workflow accordingly (registry-username, registry-password) and ensure
the corresponding secrets are created in the repo settings.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 0623871f-8c3d-4f7e-b6a5-28f2a230b7b7
📒 Files selected for processing (1)
.github/workflows/ui-cicd.yml
| registry-username: ${{ secrets.github.actor }} | ||
| registry-password: ${{ secrets.GITHUB_TOKEN }} |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
`For GitHub Actions reusable workflows:
- Is
${{ secrets.github.actor }}valid, or should actor be${{ github.actor }}? - Can
${{ secrets.GITHUB_TOKEN }}authenticate docker/login-action against Docker Hub (docker.io)?`
💡 Result:
- ${{ secrets.github.actor }} is not valid. The actor should be accessed using ${{ github.actor }}. The secrets context provides access to repository, organization, or environment secrets (e.g., ${{ secrets.MY_SECRET }}), and GITHUB_TOKEN (e.g., ${{ secrets.GITHUB_TOKEN }}). The github context provides event and run information, including github.actor which is the username of the user or app that triggered the workflow. No sources mention or validate secrets.github.actor; it would resolve to a non-existent secret named github.actor. 2) No, ${{ secrets.GITHUB_TOKEN }} cannot authenticate docker/login-action against Docker Hub (docker.io). For Docker Hub, use a Docker Hub personal access token stored as a repository secret (e.g., ${{ secrets.DOCKERHUB_TOKEN }}) with username (e.g., ${{ vars.DOCKERHUB_USERNAME }} or secret). Official docker/login-action documentation and examples explicitly recommend and show Docker Hub PAT, not GITHUB_TOKEN. GITHUB_TOKEN works for GitHub Container Registry (ghcr.io) with registry: ghcr.io, username: ${{ github.actor }}, password: ${{ secrets.GITHUB_TOKEN }}, but defaults to docker.io and requires Docker Hub credentials.
Citations:
- 1: https://docs.github.com/actions/security-guides/using-secrets-in-github-actions
- 2: https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions
- 3: https://docs.github.com/actions/guides/publishing-docker-images
- 4: https://github.com/docker/login-action
- 5: https://github.com/marketplace/actions/docker-login
- 6: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts
- 7: https://docs.github.com/en/actions/reference/contexts-reference
- 8: https://docs.github.com/en/actions/how-tos/sharing-automations/reusing-workflows#:~:text=Passing inputs and secrets to,keyword to pass named secrets.
- 9: https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows
- 10: https://docs.docker.com/guides/gha
Fix invalid actor reference and incompatible Docker Hub auth token.
Line 34 uses an invalid expression (${{ secrets.github.actor }}—the actor should be ${{ github.actor }} from the github context, not secrets). Line 35 uses GITHUB_TOKEN for docker.io auth, which will fail; GITHUB_TOKEN works only with GitHub Container Registry (ghcr.io), not Docker Hub.
🔧 Suggested fix (keep Docker Hub)
- registry-username: ${{ secrets.github.actor }}
- registry-password: ${{ secrets.GITHUB_TOKEN }}
+ registry-username: ${{ secrets.DOCKERHUB_USERNAME }}
+ registry-password: ${{ secrets.DOCKERHUB_TOKEN }}Store Docker Hub username and PAT as repository secrets.
Alternatively, migrate the registry and image target to GHCR (ghcr.io) to use GITHUB_TOKEN.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| registry-username: ${{ secrets.github.actor }} | |
| registry-password: ${{ secrets.GITHUB_TOKEN }} | |
| registry-username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| registry-password: ${{ secrets.DOCKERHUB_TOKEN }} |
🧰 Tools
🪛 actionlint (1.7.11)
[error] 34-34: receiver of object dereference "actor" must be type of object but got "string"
(expression)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/ui-cicd.yml around lines 34 - 35, Replace the incorrect
secrets reference and fix the Docker Hub auth: change the registry-username
value from the invalid secrets.github.actor to the workflow context
github.actor, and stop using secrets.GITHUB_TOKEN for docker.io auth; instead
wire in repository secrets for Docker Hub (e.g., use secrets.DOCKERHUB_USERNAME
and secrets.DOCKERHUB_PAT as the registry-username and registry-password) or
alternatively change the target registry to ghcr.io and keep GITHUB_TOKEN for
auth; update the keys referenced in the workflow accordingly (registry-username,
registry-password) and ensure the corresponding secrets are created in the repo
settings.
2 participants
Summary by CodeRabbit