From d948f11d061f8963e44eb75541a257924df3998f Mon Sep 17 00:00:00 2001
From: Alex <a@tushynski.me>
Date: Sun, 6 Sep 2026 22:49:15 +0100
Subject: [PATCH] ci: reference the Docker Hub namespace secret only from job
 env

zizmor flags a secret expanded inside with: or run:. The image workflows
put DOCKER_USERNAME in a job-level env and use that in tags, labels, cache
refs and the manifest loop; login-action keeps its username input.
---
 .github/workflows/ci.yml                   | 14 ++++++++++----
 .github/workflows/docker-develop-build.yml | 14 ++++++++++----
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 68075831..07070508 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,6 +7,9 @@ on:
 jobs:
   build:
     if: github.repository == 'arc53/DocsGPT'
+    env:
+      # Docker Hub namespace; a secret is only referenced from env blocks.
+      DOCKERHUB_NAMESPACE: ${{ secrets.DOCKER_USERNAME }}
     strategy:
       matrix:
         platform: [linux/amd64, linux/arm64]
@@ -46,7 +49,7 @@ jobs:
         uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: |
-            ${{ secrets.DOCKER_USERNAME }}/docsgpt
+            ${{ env.DOCKERHUB_NAMESPACE }}/docsgpt
             ghcr.io/${{ github.repository_owner }}/docsgpt
           labels: |
             org.opencontainers.image.title=DocsGPT${{ matrix.variant }}
@@ -63,16 +66,19 @@ jobs:
             EXTRAS=${{ matrix.variant == '-docling' && 'docling' || '' }}
             INSTALL_TESSERACT=${{ matrix.variant == '-docling' && 'true' || 'false' }}
           tags: |
-            ${{ secrets.DOCKER_USERNAME }}/docsgpt:${{ github.event.release.tag_name }}${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
+            ${{ env.DOCKERHUB_NAMESPACE }}/docsgpt:${{ github.event.release.tag_name }}${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
             ghcr.io/${{ github.repository_owner }}/docsgpt:${{ github.event.release.tag_name }}${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
           labels: ${{ steps.meta.outputs.labels }}
           provenance: false
           sbom: false
-          cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/docsgpt:latest${{ matrix.variant }}
+          cache-from: type=registry,ref=${{ env.DOCKERHUB_NAMESPACE }}/docsgpt:latest${{ matrix.variant }}
           cache-to: type=inline
 
   manifest:
     if: github.repository == 'arc53/DocsGPT'
+    env:
+      # Docker Hub namespace; a secret is only referenced from env blocks.
+      DOCKERHUB_NAMESPACE: ${{ secrets.DOCKER_USERNAME }}
     needs: build
     strategy:
       matrix:
@@ -106,7 +112,7 @@ jobs:
           LATEST: latest${{ matrix.variant }}
         run: |
           set -e
-          for repo in "${{ secrets.DOCKER_USERNAME }}/docsgpt" "ghcr.io/${{ github.repository_owner }}/docsgpt"; do
+          for repo in "$DOCKERHUB_NAMESPACE/docsgpt" "ghcr.io/${{ github.repository_owner }}/docsgpt"; do
             for name in "$TAG" "$LATEST"; do
               docker manifest create "$repo:$name" \
                 --amend "$repo:$TAG-amd64" \
diff --git a/.github/workflows/docker-develop-build.yml b/.github/workflows/docker-develop-build.yml
index baf0ffef..9d95b2e0 100644
--- a/.github/workflows/docker-develop-build.yml
+++ b/.github/workflows/docker-develop-build.yml
@@ -9,6 +9,9 @@ on:
 jobs:
   build:
     if: github.repository == 'arc53/DocsGPT'
+    env:
+      # Docker Hub namespace; a secret is only referenced from env blocks.
+      DOCKERHUB_NAMESPACE: ${{ secrets.DOCKER_USERNAME }}
     strategy:
       matrix:
         platform: [linux/amd64, linux/arm64]
@@ -48,7 +51,7 @@ jobs:
         uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: |
-            ${{ secrets.DOCKER_USERNAME }}/docsgpt
+            ${{ env.DOCKERHUB_NAMESPACE }}/docsgpt
             ghcr.io/${{ github.repository_owner }}/docsgpt
           labels: |
             org.opencontainers.image.title=DocsGPT${{ matrix.variant }}
@@ -65,16 +68,19 @@ jobs:
             EXTRAS=${{ matrix.variant == '-docling' && 'docling' || '' }}
             INSTALL_TESSERACT=${{ matrix.variant == '-docling' && 'true' || 'false' }}
           tags: |
-            ${{ secrets.DOCKER_USERNAME }}/docsgpt:develop${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
+            ${{ env.DOCKERHUB_NAMESPACE }}/docsgpt:develop${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
             ghcr.io/${{ github.repository_owner }}/docsgpt:develop${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
           labels: ${{ steps.meta.outputs.labels }}
           provenance: false
           sbom: false
-          cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/docsgpt:develop${{ matrix.variant }}
+          cache-from: type=registry,ref=${{ env.DOCKERHUB_NAMESPACE }}/docsgpt:develop${{ matrix.variant }}
           cache-to: type=inline
 
   manifest:
     if: github.repository == 'arc53/DocsGPT'
+    env:
+      # Docker Hub namespace; a secret is only referenced from env blocks.
+      DOCKERHUB_NAMESPACE: ${{ secrets.DOCKER_USERNAME }}
     needs: build
     strategy:
       matrix:
@@ -107,7 +113,7 @@ jobs:
           TAG: develop${{ matrix.variant }}
         run: |
           set -e
-          for repo in "${{ secrets.DOCKER_USERNAME }}/docsgpt" "ghcr.io/${{ github.repository_owner }}/docsgpt"; do
+          for repo in "$DOCKERHUB_NAMESPACE/docsgpt" "ghcr.io/${{ github.repository_owner }}/docsgpt"; do
             docker manifest create "$repo:$TAG" \
               --amend "$repo:$TAG-amd64" \
               --amend "$repo:$TAG-arm64"