Skip to content

Update registry credentials and secret references in CI/CD pipeline #83

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
omarghatasheh merged 2 commits into from
Mar 31, 2026
Merged

Update registry credentials and secret references in CI/CD pipeline #83

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a88ae66
fix: update registry credentials in CI/CD pipeline configuration
Mar 31, 2026
995de72
fix: update registry-username secret reference in CI/CD pipeline conf…
Mar 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/ui-cicd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ jobs:
image-name: 'simplify9/bitweenui'
helm-set-values: 'image.repo=docker.io/simplify9,ingress.enabled=true,ingress.host=app-dev.bitween.io,ingress.tlsSecret=bitween-tls,ingress.annotations.cert-manager\.io/cluster-issuer=letsencrypt-nginx'
secrets:
registry-username: ${{ secrets.S9_REGISTRY_USERNAME }}
registry-password: ${{ secrets.S9_REGISTRY_TOKEN }}
registry-username: ${{ secrets.github.actor }}
registry-password: ${{ secrets.GITHUB_TOKEN }}
Comment on lines +34 to +35

@coderabbitai coderabbitai Bot Mar 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

`For GitHub Actions reusable workflows:

  1. Is ${{ secrets.github.actor }} valid, or should actor be ${{ github.actor }}?
  2. Can ${{ secrets.GITHUB_TOKEN }} authenticate docker/login-action against Docker Hub (docker.io)?`

💡 Result:

  1. ${{ secrets.github.actor }} is not valid. The actor should be accessed using ${{ github.actor }}. The secrets context provides access to repository, organization, or environment secrets (e.g., ${{ secrets.MY_SECRET }}), and GITHUB_TOKEN (e.g., ${{ secrets.GITHUB_TOKEN }}). The github context provides event and run information, including github.actor which is the username of the user or app that triggered the workflow. No sources mention or validate secrets.github.actor; it would resolve to a non-existent secret named github.actor. 2) No, ${{ secrets.GITHUB_TOKEN }} cannot authenticate docker/login-action against Docker Hub (docker.io). For Docker Hub, use a Docker Hub personal access token stored as a repository secret (e.g., ${{ secrets.DOCKERHUB_TOKEN }}) with username (e.g., ${{ vars.DOCKERHUB_USERNAME }} or secret). Official docker/login-action documentation and examples explicitly recommend and show Docker Hub PAT, not GITHUB_TOKEN. GITHUB_TOKEN works for GitHub Container Registry (ghcr.io) with registry: ghcr.io, username: ${{ github.actor }}, password: ${{ secrets.GITHUB_TOKEN }}, but defaults to docker.io and requires Docker Hub credentials.

Citations:

Fix invalid actor reference and incompatible Docker Hub auth token.

Line 34 uses an invalid expression (${{ secrets.github.actor }}—the actor should be ${{ github.actor }} from the github context, not secrets). Line 35 uses GITHUB_TOKEN for docker.io auth, which will fail; GITHUB_TOKEN works only with GitHub Container Registry (ghcr.io), not Docker Hub.

🔧 Suggested fix (keep Docker Hub) 
-      registry-username: ${{ secrets.github.actor }}
-      registry-password: ${{ secrets.GITHUB_TOKEN }}
+      registry-username: ${{ secrets.DOCKERHUB_USERNAME }}
+      registry-password: ${{ secrets.DOCKERHUB_TOKEN }}

Store Docker Hub username and PAT as repository secrets.

Alternatively, migrate the registry and image target to GHCR (ghcr.io) to use GITHUB_TOKEN.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
registry-username: ${{ secrets.github.actor }}
registry-password: ${{ secrets.GITHUB_TOKEN }}
registry-username: ${{ secrets.DOCKERHUB_USERNAME }}
registry-password: ${{ secrets.DOCKERHUB_TOKEN }}
🧰 Tools
🪛 actionlint (1.7.11)

[error] 34-34: receiver of object dereference "actor" must be type of object but got "string"

(expression)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ui-cicd.yml around lines 34 - 35, Replace the incorrect
secrets reference and fix the Docker Hub auth: change the registry-username
value from the invalid secrets.github.actor to the workflow context
github.actor, and stop using secrets.GITHUB_TOKEN for docker.io auth; instead
wire in repository secrets for Docker Hub (e.g., use secrets.DOCKERHUB_USERNAME
and secrets.DOCKERHUB_PAT as the registry-username and registry-password) or
alternatively change the target registry to ghcr.io and keep GITHUB_TOKEN for
auth; update the keys referenced in the workflow accordingly (registry-username,
registry-password) and ensure the corresponding secrets are created in the repo
settings.

kubeconfig: ${{ secrets.S9DEV_KUBECONFIG }}
github-token: ${{ secrets.GITHUB_TOKEN }}