tiennm99/DocsGPT
1
0 Fork 0
mirror of https://github.com/tiennm99/DocsGPT.git synced 2026-10-13 20:14:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: reference the Docker Hub namespace secret only from job env

Browse Source 
zizmor flags a secret expanded inside with: or run:. The image workflows
put DOCKER_USERNAME in a job-level env and use that in tags, labels, cache
refs and the manifest loop; login-action keeps its username input.
This commit is contained in:
Alex committed 2026-09-06 22:49:15 +01:00
1 parent 9a67801515
commit d948f11d06
2 files changed
+20 -8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/ci.yml
+10 -4
View File
@@ -7,6 +7,9 @@ on:
jobs:
build:
if: github.repository == 'arc53/DocsGPT'
env:
# Docker Hub namespace; a secret is only referenced from env blocks.
DOCKERHUB_NAMESPACE: ${{ secrets.DOCKER_USERNAME }}
strategy:
matrix:
platform: [linux/amd64, linux/arm64]
@@ -46,7 +49,7 @@ jobs:
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
with:
images: |
${{ secrets.DOCKER_USERNAME }}/docsgpt
${{ env.DOCKERHUB_NAMESPACE }}/docsgpt
ghcr.io/${{ github.repository_owner }}/docsgpt
labels: |
org.opencontainers.image.title=DocsGPT${{ matrix.variant }}
@@ -63,16 +66,19 @@ jobs:
EXTRAS=${{ matrix.variant == '-docling' && 'docling' || '' }}
INSTALL_TESSERACT=${{ matrix.variant == '-docling' && 'true' || 'false' }}
tags: |
${{ secrets.DOCKER_USERNAME }}/docsgpt:${{ github.event.release.tag_name }}${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
${{ env.DOCKERHUB_NAMESPACE }}/docsgpt:${{ github.event.release.tag_name }}${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
ghcr.io/${{ github.repository_owner }}/docsgpt:${{ github.event.release.tag_name }}${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
labels: ${{ steps.meta.outputs.labels }}
provenance: false
sbom: false
cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/docsgpt:latest${{ matrix.variant }}
cache-from: type=registry,ref=${{ env.DOCKERHUB_NAMESPACE }}/docsgpt:latest${{ matrix.variant }}
cache-to: type=inline
manifest:
if: github.repository == 'arc53/DocsGPT'
env:
# Docker Hub namespace; a secret is only referenced from env blocks.
DOCKERHUB_NAMESPACE: ${{ secrets.DOCKER_USERNAME }}
needs: build
strategy:
matrix:
@@ -106,7 +112,7 @@ jobs:
LATEST: latest${{ matrix.variant }}
run: |
set -e
for repo in "${{ secrets.DOCKER_USERNAME }}/docsgpt" "ghcr.io/${{ github.repository_owner }}/docsgpt"; do
for repo in "$DOCKERHUB_NAMESPACE/docsgpt" "ghcr.io/${{ github.repository_owner }}/docsgpt"; do
for name in "$TAG" "$LATEST"; do
docker manifest create "$repo:$name" \
--amend "$repo:$TAG-amd64" \
.github/workflows/docker-develop-build.yml
+10 -4
View File
@@ -9,6 +9,9 @@ on:
jobs:
build:
if: github.repository == 'arc53/DocsGPT'
env:
# Docker Hub namespace; a secret is only referenced from env blocks.
DOCKERHUB_NAMESPACE: ${{ secrets.DOCKER_USERNAME }}
strategy:
matrix:
platform: [linux/amd64, linux/arm64]
@@ -48,7 +51,7 @@ jobs:
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
with:
images: |
${{ secrets.DOCKER_USERNAME }}/docsgpt
${{ env.DOCKERHUB_NAMESPACE }}/docsgpt
ghcr.io/${{ github.repository_owner }}/docsgpt
labels: |
org.opencontainers.image.title=DocsGPT${{ matrix.variant }}
@@ -65,16 +68,19 @@ jobs:
EXTRAS=${{ matrix.variant == '-docling' && 'docling' || '' }}
INSTALL_TESSERACT=${{ matrix.variant == '-docling' && 'true' || 'false' }}
tags: |
${{ secrets.DOCKER_USERNAME }}/docsgpt:develop${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
${{ env.DOCKERHUB_NAMESPACE }}/docsgpt:develop${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
ghcr.io/${{ github.repository_owner }}/docsgpt:develop${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
labels: ${{ steps.meta.outputs.labels }}
provenance: false
sbom: false
cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/docsgpt:develop${{ matrix.variant }}
cache-from: type=registry,ref=${{ env.DOCKERHUB_NAMESPACE }}/docsgpt:develop${{ matrix.variant }}
cache-to: type=inline
manifest:
if: github.repository == 'arc53/DocsGPT'
env:
# Docker Hub namespace; a secret is only referenced from env blocks.
DOCKERHUB_NAMESPACE: ${{ secrets.DOCKER_USERNAME }}
needs: build
strategy:
matrix:
@@ -107,7 +113,7 @@ jobs:
TAG: develop${{ matrix.variant }}
run: |
set -e
for repo in "${{ secrets.DOCKER_USERNAME }}/docsgpt" "ghcr.io/${{ github.repository_owner }}/docsgpt"; do
for repo in "$DOCKERHUB_NAMESPACE/docsgpt" "ghcr.io/${{ github.repository_owner }}/docsgpt"; do
docker manifest create "$repo:$TAG" \
--amend "$repo:$TAG-amd64" \
--amend "$repo:$TAG-arm64"