Mirror release images to Docker Hub - #149
Open
diolektor wants to merge 1 commit into
Open
Conversation
CI: - release.yml and weekly-rebuild.yml now publish every arch-specific tag, multi-arch manifest, and alias to docker.io/oxphp/oxphp in addition to ghcr.io/oxphp/oxphp. Push, manifest-list creation, and alias-move steps iterate over both registry prefixes; canonical tags and all moved aliases are cosign-signed (keyless OIDC) in both registries. - Each job that touches a registry adds a Docker Hub login step using DOCKERHUB_USERNAME / DOCKERHUB_TOKEN secrets alongside the existing ghcr login. - manifest-84 / manifest-85 export additional canonical_minor_dh / canonical_patch_dh outputs so the corresponding sign jobs can sign the Docker Hub manifests. - move-aliases.sh is invoked twice per aliases job (once with REGISTRY=ghcr.io/oxphp/oxphp, once with REGISTRY=docker.io/oxphp/oxphp); the script itself is unchanged. Config: - Added DOCKERHUB_REGISTRY and DOCKERHUB_IMAGE_NAME workflow env vars.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
release.ymlandweekly-rebuild.ymlnow publish all arch-specific tags, multi-arch manifests, and aliases todocker.io/oxphp/oxphpin parallel withghcr.io/oxphp/oxphp.scripts/move-aliases.shwas not modified (it is already parametrized viaREGISTRY).DOCKERHUB_USERNAME/DOCKERHUB_TOKEN) to every job that pushes, creates a manifest, or signs.manifest-84/manifest-85additionally exportcanonical_minor_dh/canonical_patch_dhso that the correspondingsign-*jobs also sign the DH manifests (keyless OIDC).Pre-merge requirements
oxphp/oxphprepository on Docker Hub.DOCKERHUB_USERNAME— DH loginDOCKERHUB_TOKEN— access token with Read/Write/Delete permissionsEdge case (to document)
In
weekly-rebuild.yml, theResolve last-published upstream digeststep reads the annotation only from${REGISTRY}/${IMAGE_NAME}:php${PHP_MINOR}(ghcr). On the first weekly run after DH is enabled, ghcr may returnskip=true, in which case the DH tags will not be updated in that cycle. Self-healing happens on the next PHP patch, or on the next release tag (v*.*.*is guaranteed to do a full run to both sides).Test plan
v0.0.0-dh-test) — confirm that canonical + alias tags appear in both registries, and thatcosign verifyworks on both.weekly-rebuildviaworkflow_dispatchand confirm that parity is maintained.