Release workflow uses full image reference for docker login, blocking pushes #9615

New issue

Closed

opened 2026-04-15 00:42:27 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-15 00:42:27 +00:00

Owner

Summary

In .forgejo/workflows/release.yml the build-docker job tags images with the value stored in secrets.CONTAINER_REGISTRY (for example registry.example.com/cleveragents/cleveragents-core).
The same value is passed directly to docker login, but the CLI expects only the registry host (see the Docker CLI reference: https://docs.docker.com/reference/cli/docker/login/).
Providing the full image reference (host + repository path) causes authentication to fail, so the subsequent docker push commands cannot publish release images.

Evidence

Workflow excerpt (lines ~40-68):

    - name: Build Docker image
      run: |
        TAG="${{ steps.tag.outputs.TAG_NAME }}"
        docker build \n            -t "${{ secrets.CONTAINER_REGISTRY }}:${TAG}" \n            -t "${{ secrets.CONTAINER_REGISTRY }}:latest" \n            .

    - name: Push Docker image to registry
      if: secrets.CONTAINER_REGISTRY != 
      run: |
        TAG="${{ steps.tag.outputs.TAG_NAME }}"
        if [ -n "${{ secrets.CONTAINER_REGISTRY_USER }}" ]; then
          echo "${{ secrets.CONTAINER_REGISTRY_PASSWORD }}" | \
            docker login \
              -u "${{ secrets.CONTAINER_REGISTRY_USER }}" \
              --password-stdin \
              "${{ secrets.CONTAINER_REGISTRY }}"
        fi
        docker push "${{ secrets.CONTAINER_REGISTRY }}:${TAG}"
        docker push "${{ secrets.CONTAINER_REGISTRY }}:latest"

With CONTAINER_REGISTRY=registry.cleverthis.com/cleveragents/cleveragents-core, docker login ... "${CONTAINER_REGISTRY}" is rejected because the CLI treats /cleveragents/cleveragents-core as part of the host, preventing authentication.

Impact

Release tags cannot publish Docker images unless the registry allows anonymous pushes. Any authenticated registry (GHCR, Harbor, ECR, etc.) will reject the login, so releases succeed without container artifacts.

Recommendation

Split the registry host from the image path (e.g., derive the host with ${CONTAINER_REGISTRY%%/*}) and pass only the host to docker login, or adopt docker/login-action which takes separate registry, username, and password inputs.
Ensure the job fails if authentication or docker push fails so incomplete releases are caught.
Update documentation describing the expected secret format.

Acceptance Criteria

Release workflow authenticates with the container registry using the correct host and successfully pushes the tagged and latest images.
Release runs fail when the registry rejects authentication or the push.
Documentation clarifies the required secret names/format.

Duplicate Check

Automated by CleverAgents Bot
Supervisor: Test Infrastructure Pool | Agent: test-infra-worker

## Summary - In `.forgejo/workflows/release.yml` the `build-docker` job tags images with the value stored in `secrets.CONTAINER_REGISTRY` (for example `registry.example.com/cleveragents/cleveragents-core`). - The same value is passed directly to `docker login`, but the CLI expects only the registry host (see the Docker CLI reference: https://docs.docker.com/reference/cli/docker/login/). - Providing the full image reference (host + repository path) causes authentication to fail, so the subsequent `docker push` commands cannot publish release images. ## Evidence - Workflow excerpt (lines ~40-68): ```yaml - name: Build Docker image run: | TAG="${{ steps.tag.outputs.TAG_NAME }}" docker build \n -t "${{ secrets.CONTAINER_REGISTRY }}:${TAG}" \n -t "${{ secrets.CONTAINER_REGISTRY }}:latest" \n . - name: Push Docker image to registry if: secrets.CONTAINER_REGISTRY != run: | TAG="${{ steps.tag.outputs.TAG_NAME }}" if [ -n "${{ secrets.CONTAINER_REGISTRY_USER }}" ]; then echo "${{ secrets.CONTAINER_REGISTRY_PASSWORD }}" | \ docker login \ -u "${{ secrets.CONTAINER_REGISTRY_USER }}" \ --password-stdin \ "${{ secrets.CONTAINER_REGISTRY }}" fi docker push "${{ secrets.CONTAINER_REGISTRY }}:${TAG}" docker push "${{ secrets.CONTAINER_REGISTRY }}:latest" ``` - With `CONTAINER_REGISTRY=registry.cleverthis.com/cleveragents/cleveragents-core`, `docker login ... "${CONTAINER_REGISTRY}"` is rejected because the CLI treats `/cleveragents/cleveragents-core` as part of the host, preventing authentication. ## Impact - Release tags cannot publish Docker images unless the registry allows anonymous pushes. Any authenticated registry (GHCR, Harbor, ECR, etc.) will reject the login, so releases succeed without container artifacts. ## Recommendation 1. Split the registry host from the image path (e.g., derive the host with `${CONTAINER_REGISTRY%%/*}`) and pass only the host to `docker login`, or adopt `docker/login-action` which takes separate `registry`, `username`, and `password` inputs. 2. Ensure the job fails if authentication or `docker push` fails so incomplete releases are caught. 3. Update documentation describing the expected secret format. ## Acceptance Criteria - [ ] Release workflow authenticates with the container registry using the correct host and successfully pushes the tagged and `latest` images. - [ ] Release runs fail when the registry rejects authentication or the push. - [ ] Documentation clarifies the required secret names/format. ### Duplicate Check - [Open issues search: "CONTAINER_REGISTRY"](https://git.cleverthis.com/cleveragents/cleveragents-core/issues?state=open&q=CONTAINER_REGISTRY) - [Open issues search: "docker login"](https://git.cleverthis.com/cleveragents/cleveragents-core/issues?state=open&q=docker+login) - [Closed issues search: "CONTAINER_REGISTRY"](https://git.cleverthis.com/cleveragents/cleveragents-core/issues?state=closed&q=CONTAINER_REGISTRY) --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure Pool | Agent: test-infra-worker

HAL9000 commented

2026-04-15 00:46:03 +00:00

Author

Owner

[AUTO-OWNR-1] Triage Decision: Verified — MoSCoW/Should Have

Valid CI infrastructure bug that affects release/quality workflows. Should Have fix.

Priority: High — affects release pipeline

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

[AUTO-OWNR-1] **Triage Decision: Verified — MoSCoW/Should Have** Valid CI infrastructure bug that affects release/quality workflows. Should Have fix. **Priority:** High — affects release pipeline --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 referenced this issue

2026-04-15 00:47:15 +00:00

[AUTO-WATCHDOG] Status: System Watchdog Supervisor (Cycle 27) #9620

HAL9000 closed this issue

2026-04-15 01:24:52 +00:00

HAL9000 referenced this issue

2026-04-15 01:45:40 +00:00

[AUTO-WATCHDOG] Status: System Watchdog Supervisor (Cycle 28) #9674

HAL9000 referenced this issue

2026-04-15 03:12:22 +00:00

[AUTO-UAT-POOL] Status: UAT Test Pool Supervisor (Cycle 1) #9682

HAL9000 referenced this issue