From a78d91d4957001a4036e5a26a7794ebc2f8c4aa5 Mon Sep 17 00:00:00 2001 From: Jeremy Bernard Date: Thu, 15 Oct 2026 16:44:35 +0200 Subject: [PATCH] ci: publish OCI image on Docker Hub --- .github/workflows/ci.yaml | 20 +++++++++---------- .../conventional-commit-on-pr-title.yaml | 7 ++++--- .github/workflows/promote-image.yaml | 12 +++++------ .github/workflows/release-please.yaml | 9 +++------ 4 files changed, 23 insertions(+), 25 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 101b84c6..b4b8a2a4 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -28,6 +28,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Apply branch and image tag rules id: rules @@ -58,8 +60,8 @@ jobs: permissions: contents: read # actions/checkout actions: write # actions/upload-artifact - # java-build-v1.0.0 - uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/java-build.yml@230e504041b25d1e45dad1651ac29a9b9f827dd5 + # java-build-v1.0.1 + uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/java-build.yml@0ef3bbf01085d84dc96167b099e137f11857e43e with: java-version: '21' sonar: true @@ -80,12 +82,12 @@ jobs: actions: write # actions/download-artifact + actions/upload-artifact (docker-image-tag) security-events: write # codeql-action/upload-sarif, Trivy report on pull requests pull-requests: write # peter-evans/create-or-update-comment, Hadolint report on pull requests - # docker-build-v3.7.0 - uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-build.yml@fc54a889aaabffc2acf96451d54592a90d068af9 + # docker-build-v3.8.0 + uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-build.yml@71e6b9e61eefe6ca92540523ff2589274399b7cd with: - image-name: docker-regis.iex.ec/iexec-core + image-name: docker.io/iexechub/iexec-core image-tag: ${{ needs.prepare.outputs.image_tag }} - registry: docker-regis.iex.ec + registry: docker.io push: true security-scan: false security-report: 'sarif' @@ -95,7 +97,5 @@ jobs: artifact-path: build/libs build-args: jar=${{ needs.build-and-test.outputs.jar-path }} secrets: - dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }} - dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN_PULL_ONLY }} - username: ${{ secrets.NEXUS_USERNAME }} - password: ${{ secrets.NEXUS_PASSWORD }} + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_PAT }} diff --git a/.github/workflows/conventional-commit-on-pr-title.yaml b/.github/workflows/conventional-commit-on-pr-title.yaml index 838b4e01..72abc1b8 100644 --- a/.github/workflows/conventional-commit-on-pr-title.yaml +++ b/.github/workflows/conventional-commit-on-pr-title.yaml @@ -1,11 +1,12 @@ name: Conventional Commit as PR title on: - pull_request_target: + pull_request: types: - opened - edited - reopened + - synchronize jobs: lint-pr-title: @@ -13,5 +14,5 @@ jobs: if: github.repository_owner == 'iExecBlockchainComputing' permissions: pull-requests: read - # conventional-commits-v1.2.1 - uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/conventional-commits.yml@7825b11bd6f0b141075368add5223c873d76a2d3 + # conventional-commits-v1.2.3 + uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/conventional-commits.yml@36e876b00619725344c27c59748cc44d0d4d6e44 diff --git a/.github/workflows/promote-image.yaml b/.github/workflows/promote-image.yaml index b0bf9fc3..11fa068d 100644 --- a/.github/workflows/promote-image.yaml +++ b/.github/workflows/promote-image.yaml @@ -26,12 +26,12 @@ jobs: permissions: contents: read actions: read # look up the CI run that built the tagged commit - # docker-promote-v1.0.0 - uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-promote.yml@23f97c518d217113e299e7c6a870a41422cd2163 + # docker-promote-v1.0.1 + uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-promote.yml@9ec0c55d4710ec8a4b1e0240c8231a16ff1516cc with: - image-name: docker-regis.iex.ec/iexec-core - registry: docker-regis.iex.ec + image-name: docker.io/iexechub/iexec-core + registry: docker.io security-scan: false secrets: - username: ${{ secrets.NEXUS_USERNAME }} - password: ${{ secrets.NEXUS_PASSWORD }} + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_PAT }} diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml index 17af62a1..99992045 100644 --- a/.github/workflows/release-please.yaml +++ b/.github/workflows/release-please.yaml @@ -5,17 +5,14 @@ on: branches: - main -permissions: - contents: write - issues: write - pull-requests: write +permissions: {} jobs: release-please: # Prevent execution on forks if: github.repository_owner == 'iExecBlockchainComputing' - # release-please-v2.2.1 - uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/release-please.yml@1c4f92368b01037ca4f209c2f9179cf8a07f00ff + # release-please-v2.2.3 + uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/release-please.yml@31ad5d9e686d47c7ebdd3c7df3f8c50f58415428 secrets: RELEASE_PLEASE_APPLICATION_ID: ${{ secrets.RELEASE_PLEASE_APPLICATION_ID }} RELEASE_PLEASE_PRIVATE_KEY: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }}