From 6ece75a152954633ce075443b27d2cb12cb00349 Mon Sep 17 00:00:00 2001
From: Alex <a@tushynski.me>
Date: Sun, 6 Sep 2026 23:01:43 +0100
Subject: [PATCH] ci: publish from a GitHub Actions environment and to the
 arc53 namespace

The build and manifest jobs of both image workflows declare
environment: docker-hub, so the registry credentials can be scoped to it and
protection rules applied in the repository settings (the environment is
created on first use). The image namespace is the public arc53 the compose
files pull from, not the login secret, which now only authenticates.
---
 .github/workflows/ci.yml                   | 18 ++++++++++++++----
 .github/workflows/docker-develop-build.yml | 18 ++++++++++++++----
 2 files changed, 28 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 07070508..80786d19 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,9 +7,14 @@ on:
 jobs:
   build:
     if: github.repository == 'arc53/DocsGPT'
+    # Publishing jobs run in a GitHub Actions environment so the registry
+    # credentials can be scoped to it and protection rules (required reviewers,
+    # branch restrictions) applied in the repository settings.
+    environment: docker-hub
     env:
-      # Docker Hub namespace; a secret is only referenced from env blocks.
-      DOCKERHUB_NAMESPACE: ${{ secrets.DOCKER_USERNAME }}
+      # Public namespace the compose files pull from; the login secret only
+      # authenticates the push.
+      DOCKERHUB_NAMESPACE: arc53
     strategy:
       matrix:
         platform: [linux/amd64, linux/arm64]
@@ -76,9 +81,14 @@ jobs:
 
   manifest:
     if: github.repository == 'arc53/DocsGPT'
+    # Publishing jobs run in a GitHub Actions environment so the registry
+    # credentials can be scoped to it and protection rules (required reviewers,
+    # branch restrictions) applied in the repository settings.
+    environment: docker-hub
     env:
-      # Docker Hub namespace; a secret is only referenced from env blocks.
-      DOCKERHUB_NAMESPACE: ${{ secrets.DOCKER_USERNAME }}
+      # Public namespace the compose files pull from; the login secret only
+      # authenticates the push.
+      DOCKERHUB_NAMESPACE: arc53
     needs: build
     strategy:
       matrix:
diff --git a/.github/workflows/docker-develop-build.yml b/.github/workflows/docker-develop-build.yml
index 9d95b2e0..e01c9367 100644
--- a/.github/workflows/docker-develop-build.yml
+++ b/.github/workflows/docker-develop-build.yml
@@ -9,9 +9,14 @@ on:
 jobs:
   build:
     if: github.repository == 'arc53/DocsGPT'
+    # Publishing jobs run in a GitHub Actions environment so the registry
+    # credentials can be scoped to it and protection rules (required reviewers,
+    # branch restrictions) applied in the repository settings.
+    environment: docker-hub
     env:
-      # Docker Hub namespace; a secret is only referenced from env blocks.
-      DOCKERHUB_NAMESPACE: ${{ secrets.DOCKER_USERNAME }}
+      # Public namespace the compose files pull from; the login secret only
+      # authenticates the push.
+      DOCKERHUB_NAMESPACE: arc53
     strategy:
       matrix:
         platform: [linux/amd64, linux/arm64]
@@ -78,9 +83,14 @@ jobs:
 
   manifest:
     if: github.repository == 'arc53/DocsGPT'
+    # Publishing jobs run in a GitHub Actions environment so the registry
+    # credentials can be scoped to it and protection rules (required reviewers,
+    # branch restrictions) applied in the repository settings.
+    environment: docker-hub
     env:
-      # Docker Hub namespace; a secret is only referenced from env blocks.
-      DOCKERHUB_NAMESPACE: ${{ secrets.DOCKER_USERNAME }}
+      # Public namespace the compose files pull from; the login secret only
+      # authenticates the push.
+      DOCKERHUB_NAMESPACE: arc53
     needs: build
     strategy:
       matrix: