From bd5ecc0b1af290665b414eacc04760bf52229148 Mon Sep 17 00:00:00 2001 From: Gabor Demeter Date: Sun, 12 Jul 2026 19:10:58 +0200 Subject: [PATCH] Fix: make Docker Hub README sync non-fatal and run it after the version report MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In the v1.7.0 sf-docker-images release the description PATCH returned 403 Forbidden (push-scoped tokens cannot update repo descriptions — Docker Hub requires Read/Write/Delete scope or the account password). The failing step sat before the version-report steps, so all three push jobs failed after a successful push+sign and the caller's release job was skipped. The sync step now runs last with continue-on-error: true — cosmetic sync issues can no longer block the release path. Co-Authored-By: Claude Fable 5 --- .github/workflows/docker-build-test-push.yml | 28 +++++++++++--------- 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/.github/workflows/docker-build-test-push.yml b/.github/workflows/docker-build-test-push.yml index 15cc93e..cae3387 100644 --- a/.github/workflows/docker-build-test-push.yml +++ b/.github/workflows/docker-build-test-push.yml @@ -228,18 +228,6 @@ jobs: DIGEST: ${{ steps.push.outputs.digest }} run: cosign sign --yes "${{ inputs.dockerhub-username }}/${{ inputs.image-name }}@${DIGEST}" - # Requires a read/write Docker Hub token (read-only tokens cannot update - # repository descriptions). - - name: Sync README to Docker Hub - if: ${{ inputs.image-description != '' }} - uses: peter-evans/dockerhub-description@432a30c9e07499fd01da9f8a49f0faf9e0ca5b77 # v4.0.2 - with: - username: ${{ inputs.dockerhub-username }} - password: ${{ secrets.dockerhub-token }} - repository: ${{ inputs.dockerhub-username }}/${{ inputs.image-name }} - short-description: ${{ inputs.image-description }} - readme-filepath: ${{ inputs.context }}/README.md - # Tool versions are read from the built image (source of truth, not the # Dockerfile) and aggregated by the caller's release job. - name: Build version report @@ -270,3 +258,19 @@ jobs: name: version-report-${{ inputs.image-name }} path: version-report-${{ inputs.image-name }}.md retention-days: ${{ inputs.artifact-retention-days }} + + # Cosmetic; must never fail the release path (v1.7.0 lesson: a Forbidden + # here skipped the version report and the caller's release job). + # Docker Hub's description PATCH needs a token with Read/Write/Delete + # scope (or the account password) — a push-scoped read/write token gets + # 403 Forbidden even though docker push works. + - name: Sync README to Docker Hub + if: ${{ inputs.image-description != '' }} + continue-on-error: true + uses: peter-evans/dockerhub-description@432a30c9e07499fd01da9f8a49f0faf9e0ca5b77 # v4.0.2 + with: + username: ${{ inputs.dockerhub-username }} + password: ${{ secrets.dockerhub-token }} + repository: ${{ inputs.dockerhub-username }}/${{ inputs.image-name }} + short-description: ${{ inputs.image-description }} + readme-filepath: ${{ inputs.context }}/README.md