From 1b5adebadab269c3802a46fc76a02473e50a831f Mon Sep 17 00:00:00 2001 From: Tony Knopp Date: Fri, 14 Aug 2026 13:32:34 -0400 Subject: [PATCH 1/2] [Cursor] chore: load Hub publish creds via release-secrets SSM Match ld-find-code-refs: OIDC + vars.AWS_ROLE_ARN + public Docker SSM parameters, instead of repo DOCKERHUB_* secrets. Co-authored-by: Cursor --- .github/workflows/publish-image.yml | 21 +++++++++++++++++++-- AGENTS.md | 2 +- CHANGELOG.md | 2 ++ DEVELOPMENT.md | 2 +- 4 files changed, 23 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml index 0b0841bd..e55e69dc 100644 --- a/.github/workflows/publish-image.yml +++ b/.github/workflows/publish-image.yml @@ -18,6 +18,7 @@ on: permissions: contents: read + id-token: write jobs: publish: @@ -44,14 +45,30 @@ jobs: echo "version=${VERSION}" >> "$GITHUB_OUTPUT" echo "push_latest=${PUSH_LATEST}" >> "$GITHUB_OUTPUT" + - name: Get Docker Hub credentials + uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0 + with: + aws_assume_role: ${{ vars.AWS_ROLE_ARN }} + ssm_parameter_pairs: >- + /global/services/docker/public/username = DOCKER_USERNAME, + /global/services/docker/public/token = DOCKER_TOKEN + + - name: Verify Docker credentials loaded + run: | + set -euo pipefail + if [[ -z "${DOCKER_USERNAME:-}" || -z "${DOCKER_TOKEN:-}" ]]; then + echo "::error::Docker Hub credentials were not loaded from SSM. Ensure vars.AWS_ROLE_ARN is configured for this repository (same release role used by ld-find-code-refs)." + exit 1 + fi + - name: Set up Docker Buildx uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0 - name: Log in to Docker Hub uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} + username: ${{ env.DOCKER_USERNAME }} + password: ${{ env.DOCKER_TOKEN }} - name: Docker metadata id: meta diff --git a/AGENTS.md b/AGENTS.md index 99669767..7b45369d 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -129,7 +129,7 @@ Follow [DEVELOPMENT.md](DEVELOPMENT.md): 3. Bump default `dockerImage` in `docker/action.yml` (+ README pins) to the new semver 4. Publish via GitHub Marketplace release flow (manual publish step) 5. Maintain major floating tag (`v2` for 2.x) in addition to semver tags -6. Publish the runtime image `launchdarkly/find-code-references-in-pull-request:X.Y.Z` via `.github/workflows/publish-image.yml` (tag push or `workflow_dispatch`; needs `DOCKERHUB_USERNAME` / `DOCKERHUB_TOKEN`) +6. Publish the runtime image `launchdarkly/find-code-references-in-pull-request:X.Y.Z` via `.github/workflows/publish-image.yml` (tag push or `workflow_dispatch`; Hub creds via `release-secrets` + `vars.AWS_ROLE_ARN` / SSM, same as `ld-find-code-refs`) Optional follow-up: thin the root `Dockerfile` to `FROM` that published image so default `@v2` users also skip compile-on-run. diff --git a/CHANGELOG.md b/CHANGELOG.md index f12814ee..12ee4966 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,8 @@ ### Changed +- Docker Hub image publish workflow loads credentials via `release-secrets` / SSM (same as other public LD images) instead of repo `DOCKERHUB_*` secrets + ### Fixed ## 2.3.0 diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md index 55d4c75a..f033c2d3 100644 --- a/DEVELOPMENT.md +++ b/DEVELOPMENT.md @@ -27,7 +27,7 @@ _Read more: [Example commands](https://github.com/nektos/act#example-commands)_ 6. Publish the runtime Docker image to Docker Hub (required for the optional `/docker` entry point): - Prefer tagging `vX.Y.Z` on `main` (triggers [.github/workflows/publish-image.yml](.github/workflows/publish-image.yml)), **or** - Run **Publish Docker image** via `workflow_dispatch` with `version: X.Y.Z` - - Repo secrets required: `DOCKERHUB_USERNAME`, `DOCKERHUB_TOKEN` + - Credentials: same path as other public LD images — `release-secrets` assumes `vars.AWS_ROLE_ARN` and reads `/global/services/docker/public/username` + `token` from SSM (no repo `DOCKERHUB_*` secrets) - Image: `launchdarkly/find-code-references-in-pull-request:X.Y.Z` (and `latest` when enabled) **Publishing** to the Marketplace is a manual step even if automation is used to create a release. From 3ba8240c9003133cd69724ac161c3ae7e40a92e0 Mon Sep 17 00:00:00 2001 From: Tony Knopp Date: Fri, 14 Aug 2026 13:33:20 -0400 Subject: [PATCH 2/2] [Cursor] fix: publish image from release tag with correct Hub name Checkout vX.Y.Z so the image matches the Action release, pin linux/amd64 + explicit Dockerfile, disable provenance/sbom for Hub, and verify the pushed tag before finishing. Co-authored-by: Cursor --- .github/workflows/publish-image.yml | 40 +++++++++++++++++++++++++---- DEVELOPMENT.md | 4 +-- 2 files changed, 37 insertions(+), 7 deletions(-) diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml index e55e69dc..341fbb67 100644 --- a/.github/workflows/publish-image.yml +++ b/.github/workflows/publish-image.yml @@ -4,7 +4,7 @@ on: workflow_dispatch: inputs: version: - description: Image tag without v prefix (e.g. 2.3.0) + description: Image tag without v prefix (e.g. 2.3.0). Must match an existing git tag vX.Y.Z. required: true type: string push_latest: @@ -24,9 +24,6 @@ jobs: publish: runs-on: ubuntu-latest steps: - - name: Checkout - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 - - name: Resolve version id: version run: | @@ -42,8 +39,24 @@ jobs: echo "Invalid version: ${VERSION}" exit 1 fi + if [[ ! "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + echo "Invalid version (expected X.Y.Z): ${VERSION}" + exit 1 + fi echo "version=${VERSION}" >> "$GITHUB_OUTPUT" - echo "push_latest=${PUSH_LATEST}" >> "$GITHUB_OUTPUT" + echo "git_tag=v${VERSION}" >> "$GITHUB_OUTPUT" + echo "image=launchdarkly/find-code-references-in-pull-request:${VERSION}" >> "$GITHUB_OUTPUT" + # String "true"/"false" for metadata-action enable= (must be exact). + if [[ "${PUSH_LATEST}" == "true" ]]; then + echo "push_latest=true" >> "$GITHUB_OUTPUT" + else + echo "push_latest=false" >> "$GITHUB_OUTPUT" + fi + + - name: Checkout release tag + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 + with: + ref: ${{ steps.version.outputs.git_tag }} - name: Get Docker Hub credentials uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0 @@ -75,6 +88,9 @@ jobs: uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0 with: images: launchdarkly/find-code-references-in-pull-request + # Only the tags we set below (matches docker/action.yml default image name). + flavor: | + latest=false tags: | type=raw,value=${{ steps.version.outputs.version }} type=raw,value=latest,enable=${{ steps.version.outputs.push_latest }} @@ -83,6 +99,20 @@ jobs: uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0 with: context: . + file: ./Dockerfile + platforms: linux/amd64 push: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} + provenance: false + sbom: false + + - name: Verify published image + run: | + set -euo pipefail + IMAGE="${{ steps.version.outputs.image }}" + echo "Inspecting ${IMAGE}" + docker buildx imagetools inspect "${IMAGE}" + docker pull "${IMAGE}" + docker run --rm --entrypoint git "${IMAGE}" --version + echo "OK: published ${IMAGE} (matches docker/action.yml default image repository)" diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md index f033c2d3..dac4b452 100644 --- a/DEVELOPMENT.md +++ b/DEVELOPMENT.md @@ -26,9 +26,9 @@ _Read more: [Example commands](https://github.com/nektos/act#example-commands)_ 5. Maintain the major floating tag (`v2` for 2.x) in addition to the semver tag 6. Publish the runtime Docker image to Docker Hub (required for the optional `/docker` entry point): - Prefer tagging `vX.Y.Z` on `main` (triggers [.github/workflows/publish-image.yml](.github/workflows/publish-image.yml)), **or** - - Run **Publish Docker image** via `workflow_dispatch` with `version: X.Y.Z` + - Run **Publish Docker image** via `workflow_dispatch` with `version: X.Y.Z` (builds from existing git tag `vX.Y.Z`) - Credentials: same path as other public LD images — `release-secrets` assumes `vars.AWS_ROLE_ARN` and reads `/global/services/docker/public/username` + `token` from SSM (no repo `DOCKERHUB_*` secrets) - - Image: `launchdarkly/find-code-references-in-pull-request:X.Y.Z` (and `latest` when enabled) + - Image: `launchdarkly/find-code-references-in-pull-request:X.Y.Z` (and `latest` when enabled) — must match the default `dockerImage` in [docker/action.yml](docker/action.yml) **Publishing** to the Marketplace is a manual step even if automation is used to create a release.