[PR #17] [MERGED] fix: authenticate to Docker Hub before QEMU setup to avoid rate limits #23

New issue

Closed

opened 2026-06-08 09:03:54 +00:00 by ryangr0 · 0 comments

ryangr0 commented

2026-06-08 09:03:54 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/webgrip/workflows/pull/17
Author: @Ryangr0
Created: 5/30/2026
Status: ✅ Merged
Merged: 5/30/2026
Merged by: @Ryangr0

Base: main ← Head: fix/docker-hub-rate-limit

📝 Commits (2)

736b47f fix: authenticate to Docker Hub before QEMU setup to avoid rate limits
11c1d29 fix: use DOCKER_USERNAME and DOCKER_TOKEN for Docker Hub auth

📊 Changes

2 files changed (+16 additions, -0 deletions)

View changed files

📝 .github/composite-actions/docker-build-push-ghcr/action.yml (+8 -0)
📝 .github/workflows/docker-build-and-push-ghcr.yml (+8 -0)

📄 Description

Problem

The Distribute / Docker Build and Push (GHCR) job fails on ARC runners with:

Error response from daemon: error from registry: You have reached your
unauthenticated pull rate limit.

This happens because docker/setup-qemu-action@v3 pulls docker.io/tonistiigi/binfmt:latest before any registry login occurs. On shared-IP runner sets the anonymous Docker Hub rate limit is quickly exhausted.

Example failure: https://github.com/webgrip/infrastructure/actions/runs/26684531278/job/78650402964

Fix

Composite action – adds a conditional docker/login-action@v3 step for Docker Hub before the QEMU and buildx setup steps. The step is skipped when credentials are absent (fully backward compatible).
Reusable workflow – declares DOCKER_USERNAME and DOCKER_TOKEN as optional secrets and forwards them as env vars to the composite action.

Required follow-up

After merging, add the following organization secrets (or repository secrets on each repo that calls this workflow):

Secret	Value
`DOCKER_USERNAME`	Your Docker Hub username
`DOCKER_TOKEN`	A Docker Hub Personal Access Token (read-only is sufficient)

Callers that already use secrets: inherit will pick these up automatically.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/webgrip/workflows/pull/17 **Author:** [@Ryangr0](https://github.com/Ryangr0) **Created:** 5/30/2026 **Status:** ✅ Merged **Merged:** 5/30/2026 **Merged by:** [@Ryangr0](https://github.com/Ryangr0) **Base:** `main` ← **Head:** `fix/docker-hub-rate-limit` --- ### 📝 Commits (2) - [`736b47f`](https://github.com/webgrip/workflows/commit/736b47fcb1516d6df74232f4d866dd59ee2c2bd5) fix: authenticate to Docker Hub before QEMU setup to avoid rate limits - [`11c1d29`](https://github.com/webgrip/workflows/commit/11c1d2952608f8f3e3cf2d2e549c923be2beef7a) fix: use DOCKER_USERNAME and DOCKER_TOKEN for Docker Hub auth ### 📊 Changes **2 files changed** (+16 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `.github/composite-actions/docker-build-push-ghcr/action.yml` (+8 -0) 📝 `.github/workflows/docker-build-and-push-ghcr.yml` (+8 -0) </details> ### 📄 Description ## Problem The `Distribute / Docker Build and Push (GHCR)` job fails on ARC runners with: ``` Error response from daemon: error from registry: You have reached your unauthenticated pull rate limit. ``` This happens because `docker/setup-qemu-action@v3` pulls `docker.io/tonistiigi/binfmt:latest` **before** any registry login occurs. On shared-IP runner sets the anonymous Docker Hub rate limit is quickly exhausted. Example failure: https://github.com/webgrip/infrastructure/actions/runs/26684531278/job/78650402964 ## Fix 1. **Composite action** – adds a conditional `docker/login-action@v3` step for Docker Hub *before* the QEMU and buildx setup steps. The step is skipped when credentials are absent (fully backward compatible). 2. **Reusable workflow** – declares `DOCKER_USERNAME` and `DOCKER_TOKEN` as optional secrets and forwards them as env vars to the composite action. ## Required follow-up After merging, add the following **organization secrets** (or repository secrets on each repo that calls this workflow): | Secret | Value | |--------|-------| | `DOCKER_USERNAME` | Your Docker Hub username | | `DOCKER_TOKEN` | A Docker Hub Personal Access Token (read-only is sufficient) | Callers that already use `secrets: inherit` will pick these up automatically. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

ryangr0

2026-06-08 09:03:54 +00:00

closed this issue
added the
pull-request
label

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

webgrip/workflows#23

No description provided.

Rows
Columns