ci: add Docker Hub authentication to all CI workflows that pull images#60353
Merged
Conversation
Add docker/login-action before bin/ci-wait-for-docker launch in all affected workflows to prevent Docker Hub rate limit (toomanyrequests) errors that have been recurring since April 2025. Workflows updated: - ci-backend.yml (5 jobs) - ci-nodejs.yml - ci-e2e-playwright.yml - ci-dagster.yml - ci-ai.yml - ci-agent-skills.yml (2 jobs) - ci-mcp.yml - ci-rust.yml Uses the same docker/login-action pin (v4.1.0) already used elsewhere in the repo, with existing DOCKERHUB_USERNAME/DOCKERHUB_TOKEN secrets.
Add 'if' condition to gracefully skip the login step when DOCKERHUB_USERNAME secret is not set (e.g., fork PRs or repos where the secret hasn't been added yet).
Contributor
Author
Note on secretsThe To add the secrets:
Once added, all CI workflows will automatically authenticate and get higher rate limits (200 pulls/6h for free accounts, unlimited for paid). |
Contributor
|
Reviews (1): Last reviewed commit: "ci: skip Docker Hub login when secrets a..." | Re-trigger Greptile |
gantoine
approved these changes
May 28, 2026
Piccirello
approved these changes
May 28, 2026
…ub-auth-ci-workflows
Canonical ci-backend.yml added Docker Hub login steps to the turbo-tests, check-migrations, check-openapi-types, django, and async-migrations jobs. Mirror them into the depot shadow so it stays apples-to-apples and the shadow-drift check passes. check-openapi-types is folded into the depot check-migrations job, so its login is covered there — 4 steps in depot cover the 5 canonical steps. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…hub.com/PostHog/posthog into mendral/add-dockerhub-auth-ci-workflows
Contributor
There was a problem hiding this comment.
Pull request overview
Adds Docker Hub authentication to CI workflows before starting Docker Compose stacks, aiming to reduce flaky CI failures caused by Docker Hub anonymous pull rate limits.
Changes:
- Insert
docker/login-action(pinned to v4.1.0 SHA) before Docker stack startup across multiple CI workflows. - Apply the same Docker Hub login step to both GitHub Actions workflows and the Depot backend workflow.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 17 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/ci-backend.yml | Adds Docker Hub login before multiple backend jobs bring up Docker services. |
| .github/workflows/ci-nodejs.yml | Adds Docker Hub login before Node.js job starts Docker Compose stack. |
| .github/workflows/ci-e2e-playwright.yml | Adds Docker Hub login before Playwright E2E job starts Docker services. |
| .github/workflows/ci-dagster.yml | Adds Docker Hub login before Dagster job starts Docker Compose stack. |
| .github/workflows/ci-ai.yml | Adds Docker Hub login before AI eval job starts Docker Compose stack. |
| .github/workflows/ci-agent-skills.yml | Adds Docker Hub login before agent-skills jobs start Docker services. |
| .github/workflows/ci-mcp.yml | Adds Docker Hub login before MCP job starts Docker services. |
| .github/workflows/ci-rust.yml | Adds Docker Hub login before Rust job brings up Docker dependencies. |
| .depot/workflows/ci-backend.yml | Adds Docker Hub login before multiple Depot backend jobs start Docker services. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
The secrets context is not available in step-level if: conditions, so
`if: ${{ secrets.DOCKERHUB_USERNAME != '' }}` raised "Unrecognized
named-value: 'secrets'". Map the two creds into env and check env.* in
the conditions instead.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
|
🎭 Playwright report
These issues are not necessarily caused by your changes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
docker/login-action(v4.1.0) before everybin/ci-wait-for-docker launchcall across 8 CI workflow files to authenticate Docker Hub image pulls and eliminate recurringtoomanyrequestsrate limit failuresContext
Docker Hub anonymous rate limits (100 pulls/6h per shared IP) have been causing escalating CI failures since April 2025 — 25+ occurrences across Django tests, build-images, agent skills, and Node.js workflows. The issue resurfaced May 26–27 hitting 3+ commits in a single day.
All existing
docker/login-actionsteps in the repo target GHCR only. This PR adds Docker Hub authentication using the existingDOCKERHUB_USERNAME/DOCKERHUB_TOKENsecrets.Workflows updated
ci-backend.ymlci-nodejs.ymlci-e2e-playwright.ymlci-dagster.ymlci-ai.ymlci-agent-skills.ymlci-mcp.ymlci-rust.ymlUses the same
docker/login-actionSHA pin (4907a6ddec9925e35a0a9e82d7399ccc52663121/ v4.1.0) already used in other workflows in this repo.Related insight: Docker CI: Unauthenticated Docker Hub pulls causing escalating rate limit failures
Note
Created by Mendral. Tag @mendral-app with feedback or questions.