fix(ci): the Docker Hub namespace is not the account that logs in - #536
Merged
Conversation
`libredb` was a Docker Hub user account, so one variable could answer two different questions: who authenticates, and which namespace the image is published under. Converting it to an organization on 2026-09-01 - required by the Docker-Sponsored Open Source application, which will not take a user account - split those answers apart. An organization cannot sign in, so DOCKER_HUB_USERNAME is now the owner user and the namespace needs its own variable. Left as it was, this fails silently in the worse direction. Publishing to docker.io/<owner>/libredb-studio does not error: it creates a real repository nobody pulls, while docker.io/libredb/libredb-studio - the image behind every `docker run` line in the README and the 75k pulls the DSOS application cites - quietly stops receiving releases. Nothing turns red. The login steps keep DOCKER_HUB_USERNAME and are asserted not to use the organization, because that failure is loud in a way that costs more than it looks: buildx exports every tag in one push, so a rejected Docker Hub login takes the canonical GHCR publish down with it. tests/unit/docker-hub-namespace.test.ts pins both directions.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What happened
libredbon Docker Hub was a user account. The Docker-Sponsored Open Source application requires an organization, so it was converted on 2026-09-01. An organization cannot sign in — so the singleDOCKER_HUB_USERNAMEvariable, which until now answered both "who authenticates" and "which namespace do we publish under", had to become two:DOCKER_HUB_USERNAMEcevheriDOCKER_HUB_ORGANIZATIONlibredbBoth are already set on the repository. This PR makes the workflow read the second one for the image name.
Why this is not cosmetic
The variables were changed before the workflow was. In that window, a push to
mainwould have published todocker.io/cevheri/libredb-studio— and that does not error. It creates a real repository nobody pulls, whiledocker.io/libredb/libredb-studio(the image behind everydocker runline in the README, and the 75,137 pulls the DSOS application cites) quietly stops receiving releases. Nothing turns red; the mirror just goes stale, and DSOS's own "actively developed on Docker Hub in the past 6 months" criterion erodes on its own.The opposite mistake is loud but costs more than it looks: buildx exports every tag in one push, so a rejected Docker Hub login fails the whole job including the canonical GHCR publish.
tests/unit/docker-hub-namespace.test.tspins both directions — the login must not use the organization, the image list must not use the login user, and an unset organization must leave the mirror off rather than guess a namespace.Verification — end to end, on a safe tag
Not by dispatching a version: Docker Hub tag immutability is enabled on this repo scoped to semver (
^\d+\.\d+\.\d+([-.][0-9A-Za-z.-]+)?$), so re-pushing a released version would be denied and would take GHCR down with it. Instead this branch is afix/**branch, which publishes the mutabledevtag — a full credential test that cannot touch a published release.Run 33454450035 —
Docker Build and Push, success. Then measured from Docker Hub rather than inferred from the green tick:libredb/libredb-studio:dev—tag_last_pushed: 2026-09-01T00:24:09Z, from this runcevheri/libredb-studio— 404, nothing leaked into the login user's namespace/v2/orgs/libredb/—type: Organization, the conversion is liveGates:
format·lint·typecheck·knip·buildclean; the three workflow-shape suites (release-sbom,release-provenance,docker-hub-namespace) 55 pass.docs/DISTRIBUTION.mdupdated so the credentials table explains why there are two variables rather than leaving the next reader to collapse them back into one.