This repository was archived by the owner on Jun 16, 2026. It is now read-only.
ci: use dockerpublicbot PAT for Docker Hub login (stopgap)#10
Merged
Conversation
The Build and Release workflow failed at "Login to Docker Hub" with "Password required" because the org secret DOCKERBUILDBOT_READ_PAT is not shared with docker/envoy, so it resolved to empty. As a stopgap, authenticate with the dockerpublicbot read PAT, whose org secret DOCKERPUBLICBOT_READ_PAT is already available to this repo. A read PAT is sufficient to pull the envoy-build-ubuntu base image past Docker Hub's anonymous rate limits. Revert to dockerbuildbot once the org grants DOCKERBUILDBOT_READ_PAT access to docker/envoy. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
Build and Releaseworkflow fails at Login to Docker Hub withPassword required(run 27558649432). The step referencessecrets.DOCKERBUILDBOT_READ_PAT, but that org secret is not shared withdocker/envoy(and there is no repo-level secret), so the password interpolates to empty.The Docker Hub login is needed to pull
envoyproxy/envoy-build-ubuntu(the build base image,Dockerfile:2) without hitting Docker Hub's anonymous pull rate limits.Change (stopgap)
Authenticate with the
dockerpublicbotaccount instead, whoseDOCKERPUBLICBOT_READ_PATorg secret is already available to this repo. A read PAT is sufficient for image pulls.Follow-up
This is a stopgap. The preferred fix is for an org admin to grant
docker/envoyaccess toDOCKERBUILDBOT_READ_PAT(the org-wide convention used by every other docker repo), after which we revert todockerbuildbot. That request is in progress with infra.Related
id-token: writefor the AWS OIDC step (next failure after login)🤖 Generated with Claude Code