Skip to content

Commit 55dc4fa

Browse files
NilashishCclaude[bot]
NilashishC
and
claude[bot]
authored
fix: enforce GITHUB_TOKEN for ghcr.io registry login (#570)
The `||` fallback in the container registry login step allowed REGISTRY_USERNAME/REGISTRY_PASSWORD secrets to override the default GITHUB_TOKEN credentials even when the target registry was ghcr.io. Replace the fallback with an explicit branch: ghcr.io always authenticates with github.actor + secrets.GITHUB_TOKEN; any other registry uses secrets.REGISTRY_USERNAME + secrets.REGISTRY_PASSWORD. Made-with: Cursor Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
1 parent a0e4c12 commit 55dc4fa

3 files changed

Lines changed: 66 additions & 24 deletions

File tree

‎src/ansible_creator/resources/common/ee-ci/.github/workflows/ee-build.yml.j2‎

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -310,10 +310,17 @@ env:
310310
311311
- name: Login to container registry
312312
run: |
313-
echo "${{ secrets.REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" | \
314-
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
315-
-u "${{ secrets.REGISTRY_USERNAME || github.actor }}" \
316-
--password-stdin "${{ env.REGISTRY }}"
313+
if [[ "${{ env.REGISTRY }}" == "ghcr.io" ]]; then
314+
echo "${{ secrets.GITHUB_TOKEN }}" | \
315+
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
316+
-u "${{ github.actor }}" \
317+
--password-stdin "${{ env.REGISTRY }}"
318+
else
319+
echo "${{ secrets.REGISTRY_PASSWORD }}" | \
320+
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
321+
-u "${{ secrets.REGISTRY_USERNAME }}" \
322+
--password-stdin "${{ env.REGISTRY }}"
323+
fi
317324
318325
- name: Login to Red Hat registry (for base images)
319326
if: vars.REDHAT_REGISTRY_USERNAME != ''
@@ -431,10 +438,17 @@ env:
431438
steps:
432439
- name: Login to container registry
433440
run: |
434-
echo "${{ secrets.REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" | \
435-
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
436-
-u "${{ secrets.REGISTRY_USERNAME || github.actor }}" \
437-
--password-stdin "${{ env.REGISTRY }}"
441+
if [[ "${{ env.REGISTRY }}" == "ghcr.io" ]]; then
442+
echo "${{ secrets.GITHUB_TOKEN }}" | \
443+
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
444+
-u "${{ github.actor }}" \
445+
--password-stdin "${{ env.REGISTRY }}"
446+
else
447+
echo "${{ secrets.REGISTRY_PASSWORD }}" | \
448+
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
449+
-u "${{ secrets.REGISTRY_USERNAME }}" \
450+
--password-stdin "${{ env.REGISTRY }}"
451+
fi
438452
439453
- name: Tag and push release
440454
env:

‎tests/fixtures/common/ee-ci/.github/workflows/ee-build.yml‎

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -257,10 +257,17 @@ jobs:
257257
258258
- name: Login to container registry
259259
run: |
260-
echo "${{ secrets.REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" | \
261-
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
262-
-u "${{ secrets.REGISTRY_USERNAME || github.actor }}" \
263-
--password-stdin "${{ env.REGISTRY }}"
260+
if [[ "${{ env.REGISTRY }}" == "ghcr.io" ]]; then
261+
echo "${{ secrets.GITHUB_TOKEN }}" | \
262+
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
263+
-u "${{ github.actor }}" \
264+
--password-stdin "${{ env.REGISTRY }}"
265+
else
266+
echo "${{ secrets.REGISTRY_PASSWORD }}" | \
267+
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
268+
-u "${{ secrets.REGISTRY_USERNAME }}" \
269+
--password-stdin "${{ env.REGISTRY }}"
270+
fi
264271
265272
- name: Login to Red Hat registry (for base images)
266273
if: vars.REDHAT_REGISTRY_USERNAME != ''
@@ -341,10 +348,17 @@ jobs:
341348
steps:
342349
- name: Login to container registry
343350
run: |
344-
echo "${{ secrets.REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" | \
345-
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
346-
-u "${{ secrets.REGISTRY_USERNAME || github.actor }}" \
347-
--password-stdin "${{ env.REGISTRY }}"
351+
if [[ "${{ env.REGISTRY }}" == "ghcr.io" ]]; then
352+
echo "${{ secrets.GITHUB_TOKEN }}" | \
353+
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
354+
-u "${{ github.actor }}" \
355+
--password-stdin "${{ env.REGISTRY }}"
356+
else
357+
echo "${{ secrets.REGISTRY_PASSWORD }}" | \
358+
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
359+
-u "${{ secrets.REGISTRY_USERNAME }}" \
360+
--password-stdin "${{ env.REGISTRY }}"
361+
fi
348362
349363
- name: Tag and push release
350364
env:

‎tests/fixtures/project/ee_project/.github/workflows/ee-build.yml‎

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -257,10 +257,17 @@ jobs:
257257
258258
- name: Login to container registry
259259
run: |
260-
echo "${{ secrets.REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" | \
261-
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
262-
-u "${{ secrets.REGISTRY_USERNAME || github.actor }}" \
263-
--password-stdin "${{ env.REGISTRY }}"
260+
if [[ "${{ env.REGISTRY }}" == "ghcr.io" ]]; then
261+
echo "${{ secrets.GITHUB_TOKEN }}" | \
262+
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
263+
-u "${{ github.actor }}" \
264+
--password-stdin "${{ env.REGISTRY }}"
265+
else
266+
echo "${{ secrets.REGISTRY_PASSWORD }}" | \
267+
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
268+
-u "${{ secrets.REGISTRY_USERNAME }}" \
269+
--password-stdin "${{ env.REGISTRY }}"
270+
fi
264271
265272
- name: Login to Red Hat registry (for base images)
266273
if: vars.REDHAT_REGISTRY_USERNAME != ''
@@ -341,10 +348,17 @@ jobs:
341348
steps:
342349
- name: Login to container registry
343350
run: |
344-
echo "${{ secrets.REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" | \
345-
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
346-
-u "${{ secrets.REGISTRY_USERNAME || github.actor }}" \
347-
--password-stdin "${{ env.REGISTRY }}"
351+
if [[ "${{ env.REGISTRY }}" == "ghcr.io" ]]; then
352+
echo "${{ secrets.GITHUB_TOKEN }}" | \
353+
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
354+
-u "${{ github.actor }}" \
355+
--password-stdin "${{ env.REGISTRY }}"
356+
else
357+
echo "${{ secrets.REGISTRY_PASSWORD }}" | \
358+
buildah login --tls-verify=${{ env.EE_REGISTRY_TLS_VERIFY }} \
359+
-u "${{ secrets.REGISTRY_USERNAME }}" \
360+
--password-stdin "${{ env.REGISTRY }}"
361+
fi
348362
349363
- name: Tag and push release
350364
env:

0 commit comments

Comments
 (0)