chore: load Hub publish creds via release-secrets SSM

.github/workflows/publish-image.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: Image tag without v prefix (e.g. 2.3.0)
+        description: Image tag without v prefix (e.g. 2.3.0). Must match an existing git tag vX.Y.Z.
         required: true
         type: string
       push_latest:
@@ -18,14 +18,12 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
-
       - name: Resolve version
         id: version
         run: |
@@ -41,23 +39,58 @@ jobs:
             echo "Invalid version: ${VERSION}"
             exit 1
           fi
+          if [[ ! "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Invalid version (expected X.Y.Z): ${VERSION}"
+            exit 1
+          fi
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-          echo "push_latest=${PUSH_LATEST}" >> "$GITHUB_OUTPUT"
+          echo "git_tag=v${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "image=launchdarkly/find-code-references-in-pull-request:${VERSION}" >> "$GITHUB_OUTPUT"
+          # String "true"/"false" for metadata-action enable= (must be exact).
+          if [[ "${PUSH_LATEST}" == "true" ]]; then
+            echo "push_latest=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "push_latest=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Checkout release tag
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        with:
+          ref: ${{ steps.version.outputs.git_tag }}
+
+      - name: Get Docker Hub credentials
+        uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
+        with:
+          aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
+          ssm_parameter_pairs: >-
+            /global/services/docker/public/username = DOCKER_USERNAME,
+            /global/services/docker/public/token = DOCKER_TOKEN
+
+      - name: Verify Docker credentials loaded
+        run: |
+          set -euo pipefail
+          if [[ -z "${DOCKER_USERNAME:-}" || -z "${DOCKER_TOKEN:-}" ]]; then
+            echo "::error::Docker Hub credentials were not loaded from SSM. Ensure vars.AWS_ROLE_ARN is configured for this repository (same release role used by ld-find-code-refs)."
+            exit 1
+          fi
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
 
       - name: Log in to Docker Hub
         uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          username: ${{ env.DOCKER_USERNAME }}
+          password: ${{ env.DOCKER_TOKEN }}
 
       - name: Docker metadata
         id: meta
         uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
         with:
           images: launchdarkly/find-code-references-in-pull-request
+          # Only the tags we set below (matches docker/action.yml default image name).
+          flavor: |
+            latest=false
           tags: |
             type=raw,value=${{ steps.version.outputs.version }}
             type=raw,value=latest,enable=${{ steps.version.outputs.push_latest }}
@@ -66,6 +99,20 @@ jobs:
         uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
         with:
           context: .
+          file: ./Dockerfile
+          platforms: linux/amd64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          provenance: false
+          sbom: false
+
+      - name: Verify published image
+        run: |
+          set -euo pipefail
+          IMAGE="${{ steps.version.outputs.image }}"
+          echo "Inspecting ${IMAGE}"
+          docker buildx imagetools inspect "${IMAGE}"
+          docker pull "${IMAGE}"
+          docker run --rm --entrypoint git "${IMAGE}" --version
+          echo "OK: published ${IMAGE} (matches docker/action.yml default image repository)"

AGENTS.md

@@ -129,7 +129,7 @@ Follow [DEVELOPMENT.md](DEVELOPMENT.md):
 3. Bump default `dockerImage` in `docker/action.yml` (+ README pins) to the new semver
 4. Publish via GitHub Marketplace release flow (manual publish step)
 5. Maintain major floating tag (`v2` for 2.x) in addition to semver tags
-6. Publish the runtime image `launchdarkly/find-code-references-in-pull-request:X.Y.Z` via `.github/workflows/publish-image.yml` (tag push or `workflow_dispatch`; needs `DOCKERHUB_USERNAME` / `DOCKERHUB_TOKEN`)
+6. Publish the runtime image `launchdarkly/find-code-references-in-pull-request:X.Y.Z` via `.github/workflows/publish-image.yml` (tag push or `workflow_dispatch`; Hub creds via `release-secrets` + `vars.AWS_ROLE_ARN` / SSM, same as `ld-find-code-refs`)
 
 Optional follow-up: thin the root `Dockerfile` to `FROM` that published image so default `@v2` users also skip compile-on-run.
 

CHANGELOG.md

@@ -4,6 +4,8 @@
 
 ### Changed
 
+- Docker Hub image publish workflow loads credentials via `release-secrets` / SSM (same as other public LD images) instead of repo `DOCKERHUB_*` secrets
+
 ### Fixed
 
 ## 2.3.0

DEVELOPMENT.md

@@ -26,9 +26,9 @@ _Read more: [Example commands](https://github.com/nektos/act#example-commands)_
 5. Maintain the major floating tag (`v2` for 2.x) in addition to the semver tag
 6. Publish the runtime Docker image to Docker Hub (required for the optional `/docker` entry point):
    - Prefer tagging `vX.Y.Z` on `main` (triggers [.github/workflows/publish-image.yml](.github/workflows/publish-image.yml)), **or**
-   - Run **Publish Docker image** via `workflow_dispatch` with `version: X.Y.Z`
-   - Repo secrets required: `DOCKERHUB_USERNAME`, `DOCKERHUB_TOKEN`
-   - Image: `launchdarkly/find-code-references-in-pull-request:X.Y.Z` (and `latest` when enabled)
+   - Run **Publish Docker image** via `workflow_dispatch` with `version: X.Y.Z` (builds from existing git tag `vX.Y.Z`)
+   - Credentials: same path as other public LD images — `release-secrets` assumes `vars.AWS_ROLE_ARN` and reads `/global/services/docker/public/username` + `token` from SSM (no repo `DOCKERHUB_*` secrets)
+   - Image: `launchdarkly/find-code-references-in-pull-request:X.Y.Z` (and `latest` when enabled) — must match the default `dockerImage` in [docker/action.yml](docker/action.yml)
 
 **Publishing** to the Marketplace is a manual step even if automation is used to create a release.