0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 02:54:26 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 4.8 20ab8ee76b ci(fork): key trusted fork PRs off the '🛡️ Trusted' label

Switch the label that flips a fork PR to the trusted (PR-head, with
credentials) path from 'trusted-pr' to '🛡️ Trusted', in the
pull_request_target gating and the orchestrator text, plus the docs.
The trusted_pr input names are unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-28 19:58:54 +02:00

2.3 KiB

Raw Permalink Blame History

GHCR Authentication 🔑

This guide explains how GitHub Container Registry (GHCR) authentication works for mirroring images via GitHub Actions.

How Authentication Works 🔑

All workflows use secrets.GITHUB_TOKEN to log in to GHCR:

- name: Login to GHCR
  uses: docker/login-action@...
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

No personal access token (PAT) or additional secrets are required.

Why GITHUB_TOKEN Is the Correct Choice ✅

When a workflow runs in a public repository and pushes to GHCR using GITHUB_TOKEN, GitHub automatically:

Links the package to the repository.
Sets the package visibility to match the repository visibility (public → public).

This means mirrored images are published as public packages without any additional configuration.

Docker Hub Rate Limits 🐳

To avoid Docker Hub pull rate limits when mirroring images, configure the following optional secrets:

Name	Type	Description
`DOCKERHUB_USERNAME`	Secret	Docker Hub username
`DOCKERHUB_TOKEN`	Secret	Docker Hub access token

These are used only for pulling source images from Docker Hub and are not required for GHCR authentication.

Fork Pull Requests 🍴

Secrets are NOT available in pull_request workflows triggered by forks. This is a GitHub security restriction. The mirror and image build run via pull_request_target instead:

A fork PR triggers a pull_request_target run that builds and mirrors any new images needed by the fork, authenticating to GHCR with the per-job GITHUB_TOKEN.
The pull_request orchestrator then waits for and consumes those images.
Untrusted fork builds run without organization secrets (secrets: inherit is not passed); Docker Hub mirror credentials are passed only for maintainer-trusted PRs (the 🛡️ Trusted label). See pipeline.md.

Troubleshooting 🔧

If a push to GHCR fails with denied: denied:

Verify the workflow has packages: write in its permissions block.
Confirm the repository is public (private repositories require additional package visibility configuration).
Re-run the workflow after any permission or visibility changes.

2.3 KiB Raw Permalink Blame History