Skip to content

Commit b843de7

Browse files
Copilotneilime
Copilot
and
neilime
committed
docs: clarify reviewed registry role format
Co-authored-by: neilime <314088+neilime@users.noreply.github.com>
1 parent f40b73e commit b843de7

6 files changed

Lines changed: 42 additions & 33 deletions

File tree

‎.github/workflows/docker-build-images.md‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -77,14 +77,14 @@ jobs:
7777
# Accepts either a registry hostname string or a JSON object with
7878
# `pull`, `pull:<name>`, `push` and `cache` keys.
7979
# Example:
80-
# `{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io","cache":"ghcr.io"}`
80+
# `{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io"}`
8181
# Default: `ghcr.io`
8282
oci-registry: ghcr.io
8383

8484
# Username configuration used to log against OCI registries.
8585
# Accepts either a single username string or a JSON object using the same keys as `oci-registry`.
8686
# Example:
87-
# `{"pull:private":"${{ github.repository_owner }}","push":"${{ github.repository_owner }}","cache":"${{ github.repository_owner }}"}`
87+
# `{"pull:private":"${{ github.repository_owner }}","push":"${{ github.repository_owner }}"}`
8888
# See https://github.com/docker/login-action#usage.
8989
#
9090
# Default: `${{ github.repository_owner }}`
@@ -231,16 +231,17 @@ To configure distinct pull, push and cache registries, pass JSON objects:
231231
```yaml
232232
with:
233233
oci-registry: |
234-
{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io","cache":"ghcr.io"}
234+
{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io"}
235235
oci-registry-username: |
236-
{"pull:private":"${{ github.repository_owner }}","push":"${{ github.repository_owner }}","cache":"${{ github.repository_owner }}"}
236+
{"pull:private":"${{ github.repository_owner }}","push":"${{ github.repository_owner }}"}
237237
secrets:
238238
oci-registry-password: |
239-
{"pull:private":"${{ github.token }}","push":"${{ github.token }}","cache":"${{ github.token }}"}
239+
{"pull:private":"${{ github.token }}","push":"${{ github.token }}"}
240240
```
241241

242242
Registry credentials are resolved by role using the same keys as `oci-registry`.
243243
`pull` is the default pull registry, while `pull:<name>` can be repeated for additional pull registries.
244+
When no pull registry is provided, the push registry is also used for pulls.
244245
Optional pull registries without credentials are skipped, which is useful for public registries such as Docker Hub.
245246

246247
### Images entry parameters

‎.github/workflows/docker-build-images.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,20 +18,21 @@ on: # yamllint disable-line rule:truthy
1818
description: |
1919
OCI registry configuration used to pull, push and cache images.
2020
Accepts either a registry hostname string (legacy format) or a JSON object.
21-
JSON example: `{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io","cache":"ghcr.io"}`
21+
JSON example: `{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io"}`
2222
JSON object keys:
2323
- `pull`: registry used to pull public or default base images
2424
- `pull:<name>`: additional pull registry
2525
- `push`: registry used for published images
2626
- `cache`: registry used when `cache-type` is `registry`
27+
If no `pull` key is provided, the `push` registry is also used for pulls.
2728
type: string
2829
default: "ghcr.io"
2930
required: false
3031
oci-registry-username:
3132
description: |
3233
Username configuration used to log against OCI registries.
3334
Accepts either a single username string (legacy format) or a JSON object using the same keys as `oci-registry`.
34-
JSON example: `{"pull:private":"my-user","push":"my-user","cache":"my-user"}`
35+
JSON example: `{"pull:private":"my-user","push":"my-user"}`
3536
See https://github.com/docker/login-action#usage.
3637
type: string
3738
default: ${{ github.repository_owner }}
@@ -115,7 +116,7 @@ on: # yamllint disable-line rule:truthy
115116
description: |
116117
Password or GitHub token (`packages:read` and `packages:write` scopes) configuration used to log against OCI registries.
117118
Accepts either a single password/token string (legacy format) or a JSON object using the same keys as `oci-registry`.
118-
JSON example: `{"pull:private":"my-token","push":"my-token","cache":"my-token"}`
119+
JSON example: `{"pull:private":"my-token","push":"my-token"}`
119120
See https://github.com/docker/login-action#usage.
120121
required: true
121122
build-secrets:

‎actions/docker/build-image/README.md‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -52,15 +52,15 @@ permissions:
5252
# Accepts either a registry hostname string or a JSON object with
5353
# `pull`, `pull:<name>`, `push` and `cache` keys.
5454
# Example:
55-
# `{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io","cache":"ghcr.io"}`
55+
# `{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io"}`
5656
# This input is required.
5757
# Default: `ghcr.io`
5858
oci-registry: ghcr.io
5959

6060
# Username configuration used to log against OCI registries.
6161
# Accepts either a single username string or a JSON object using the same keys as `oci-registry`.
6262
# Example:
63-
# `{"pull:private":"${{ github.repository_owner }}","push":"${{ github.repository_owner }}","cache":"${{ github.repository_owner }}"}`
63+
# `{"pull:private":"${{ github.repository_owner }}","push":"${{ github.repository_owner }}"}`
6464
# See https://github.com/docker/login-action#usage.
6565
#
6666
# This input is required.
@@ -70,7 +70,7 @@ permissions:
7070
# Password or personal access token configuration used to log against OCI registries.
7171
# Accepts either a single password/token string or a JSON object using the same keys as `oci-registry`.
7272
# Example:
73-
# `{"pull:private":"${{ github.token }}","push":"${{ github.token }}","cache":"${{ github.token }}"}`
73+
# `{"pull:private":"${{ github.token }}","push":"${{ github.token }}"}`
7474
# Can be passed in using `secrets.GITHUB_TOKEN`.
7575
# See https://github.com/docker/login-action#usage.
7676
#
@@ -218,15 +218,16 @@ To configure distinct pull, push and cache registries, pass JSON objects:
218218

219219
```yaml
220220
oci-registry: |
221-
{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io","cache":"ghcr.io"}
221+
{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io"}
222222
oci-registry-username: |
223-
{"pull:private":"${{ github.repository_owner }}","push":"${{ github.repository_owner }}","cache":"${{ github.repository_owner }}"}
223+
{"pull:private":"${{ github.repository_owner }}","push":"${{ github.repository_owner }}"}
224224
oci-registry-password: |
225-
{"pull:private":"${{ github.token }}","push":"${{ github.token }}","cache":"${{ github.token }}"}
225+
{"pull:private":"${{ github.token }}","push":"${{ github.token }}"}
226226
```
227227

228228
Registry credentials are resolved by role using the same keys as `oci-registry`.
229229
`pull` is the default pull registry, while `pull:<name>` can be repeated for additional pull registries.
230+
When no pull registry is provided, the push registry is also used for pulls.
230231
Optional pull registries without credentials are skipped, which is useful for public registries such as Docker Hub.
231232

232233
<!-- examples:start -->

‎actions/docker/build-image/action.yml‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,27 +15,28 @@ inputs:
1515
description: |
1616
OCI registry configuration used to pull, push and cache images.
1717
Accepts either a registry hostname string (legacy format) or a JSON object.
18-
JSON example: `{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io","cache":"ghcr.io"}`
18+
JSON example: `{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io"}`
1919
JSON object keys:
2020
- `pull`: registry used to pull public or default base images
2121
- `pull:<name>`: additional pull registry
2222
- `push`: registry used for published images
2323
- `cache`: registry used when `cache-type` is `registry`
24+
If no `pull` key is provided, the `push` registry is also used for pulls.
2425
default: "ghcr.io"
2526
required: true
2627
oci-registry-username:
2728
description: |
2829
Username configuration used to log against OCI registries.
2930
Accepts either a single username string (legacy format) or a JSON object using the same keys as `oci-registry`.
30-
JSON example: `{"pull:private":"${{ github.repository_owner }}","push":"${{ github.repository_owner }}","cache":"${{ github.repository_owner }}"}`
31+
JSON example: `{"pull:private":"${{ github.repository_owner }}","push":"${{ github.repository_owner }}"}`
3132
See https://github.com/docker/login-action#usage.
3233
default: ${{ github.repository_owner }}
3334
required: true
3435
oci-registry-password:
3536
description: |
3637
Password or personal access token configuration used to log against OCI registries.
3738
Accepts either a single password/token string (legacy format) or a JSON object using the same keys as `oci-registry`.
38-
JSON example: `{"pull:private":"${{ github.token }}","push":"${{ github.token }}","cache":"${{ github.token }}"}`
39+
JSON example: `{"pull:private":"${{ github.token }}","push":"${{ github.token }}"}`
3940
Can be passed in using `secrets.GITHUB_TOKEN`.
4041
See https://github.com/docker/login-action#usage.
4142
default: ${{ github.token }}
@@ -211,7 +212,7 @@ runs:
211212
}, {});
212213
}
213214
214-
function resolveCredential(credentialMap, role, registry, pushRegistry) {
215+
function resolveCredentialByRole(credentialMap, role, registry, pushRegistry) {
215216
const legacyCredential = credentialMap.legacy ?? '';
216217
217218
if (role === 'push') {
@@ -286,8 +287,8 @@ runs:
286287
const registryLoginsByRegistry = new Map();
287288
for (const registryEntry of registryEntries) {
288289
const { role, registry, required } = registryEntry;
289-
const username = resolveCredential(usernameByRole, role, registry, pushRegistry);
290-
const password = resolveCredential(passwordByRole, role, registry, pushRegistry);
290+
const username = resolveCredentialByRole(usernameByRole, role, registry, pushRegistry);
291+
const password = resolveCredentialByRole(passwordByRole, role, registry, pushRegistry);
291292
292293
if ((username && !password) || (!username && password)) {
293294
throw new Error(`Credentials for "${role}" must define both username and password`);
@@ -301,8 +302,13 @@ runs:
301302
throw new Error(`Conflicting credentials configured for registry "${registry}"`);
302303
}
303304
304-
existingRegistryLogin.username ||= username;
305-
existingRegistryLogin.password ||= password;
305+
if (!existingRegistryLogin.username && username) {
306+
existingRegistryLogin.username = username;
307+
}
308+
309+
if (!existingRegistryLogin.password && password) {
310+
existingRegistryLogin.password = password;
311+
}
306312
existingRegistryLogin.required ||= required;
307313
continue;
308314
}

‎actions/docker/create-images-manifests/README.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -51,15 +51,15 @@ permissions:
5151
# Accepts either a registry hostname string or a JSON object with
5252
# `pull`, `pull:<name>`, `push` and `cache` keys.
5353
# Example:
54-
# `{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io","cache":"ghcr.io"}`
54+
# `{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io"}`
5555
# This input is required.
5656
# Default: `ghcr.io`
5757
oci-registry: ghcr.io
5858

5959
# Username configuration used to log against OCI registries.
6060
# Accepts either a single username string or a JSON object using the same keys as `oci-registry`.
6161
# Example:
62-
# `{"pull:private":"${{ github.repository_owner }}","push":"${{ github.repository_owner }}","cache":"${{ github.repository_owner }}"}`
62+
# `{"pull:private":"${{ github.repository_owner }}","push":"${{ github.repository_owner }}"}`
6363
# See https://github.com/docker/login-action#usage.
6464
# This input is required.
6565
# Default: `${{ github.repository_owner }}`
@@ -68,7 +68,7 @@ permissions:
6868
# Password or personal access token configuration used to log against OCI registries.
6969
# Accepts either a single password/token string or a JSON object using the same keys as `oci-registry`.
7070
# Example:
71-
# `{"pull:private":"${{ github.token }}","push":"${{ github.token }}","cache":"${{ github.token }}"}`
71+
# `{"pull:private":"${{ github.token }}","push":"${{ github.token }}"}`
7272
# Can be passed in using `secrets.GITHUB_TOKEN`.
7373
# See https://github.com/docker/login-action#usage.
7474
#
@@ -154,11 +154,11 @@ To configure distinct pull, push and cache registries, pass JSON objects:
154154

155155
```yaml
156156
oci-registry: |
157-
{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io","cache":"ghcr.io"}
157+
{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io"}
158158
oci-registry-username: |
159-
{"pull:private":"${{ github.repository_owner }}","push":"${{ github.repository_owner }}","cache":"${{ github.repository_owner }}"}
159+
{"pull:private":"${{ github.repository_owner }}","push":"${{ github.repository_owner }}"}
160160
oci-registry-password: |
161-
{"pull:private":"${{ github.token }}","push":"${{ github.token }}","cache":"${{ github.token }}"}
161+
{"pull:private":"${{ github.token }}","push":"${{ github.token }}"}
162162
```
163163

164164
Registry credentials are resolved by role using the same keys as `oci-registry`.

‎actions/docker/create-images-manifests/action.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ inputs:
1515
description: |
1616
OCI registry configuration used to pull, push and cache images.
1717
Accepts either a registry hostname string (legacy format) or a JSON object.
18-
JSON example: `{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io","cache":"ghcr.io"}`
18+
JSON example: `{"pull":"docker.io","pull:private":"ghcr.io","push":"ghcr.io"}`
1919
JSON object keys:
2020
- `pull`: registry used to pull public or default base images
2121
- `pull:<name>`: additional pull registry
@@ -27,15 +27,15 @@ inputs:
2727
description: |
2828
Username configuration used to log against OCI registries.
2929
Accepts either a single username string (legacy format) or a JSON object using the same keys as `oci-registry`.
30-
JSON example: `{"pull:private":"${{ github.repository_owner }}","push":"${{ github.repository_owner }}","cache":"${{ github.repository_owner }}"}`
30+
JSON example: `{"pull:private":"${{ github.repository_owner }}","push":"${{ github.repository_owner }}"}`
3131
See https://github.com/docker/login-action#usage.
3232
default: ${{ github.repository_owner }}
3333
required: true
3434
oci-registry-password:
3535
description: |
3636
Password or personal access token configuration used to log against OCI registries.
3737
Accepts either a single password/token string (legacy format) or a JSON object using the same keys as `oci-registry`.
38-
JSON example: `{"pull:private":"${{ github.token }}","push":"${{ github.token }}","cache":"${{ github.token }}"}`
38+
JSON example: `{"pull:private":"${{ github.token }}","push":"${{ github.token }}"}`
3939
Can be passed in using `secrets.GITHUB_TOKEN`.
4040
See https://github.com/docker/login-action#usage.
4141
default: ${{ github.token }}
@@ -210,8 +210,8 @@ runs:
210210
if (registryInput.legacy) {
211211
registries.push(registryInput.legacy);
212212
} else {
213-
const pullRegistryEntry = Object.entries(registryInput).find(([key]) => isPullRole(key));
214-
const pushRegistry = registryInput.push ?? registryInput.cache ?? pullRegistryEntry?.[1] ?? '';
213+
const [, firstPullRegistryValue] = Object.entries(registryInput).find(([key]) => isPullRole(key)) ?? [];
214+
const pushRegistry = registryInput.push ?? registryInput.cache ?? firstPullRegistryValue ?? '';
215215
if (!pushRegistry.length) {
216216
throw new Error('Unable to resolve any OCI registry to authenticate against');
217217
}

0 commit comments

Comments
 (0)