CI: make sure we log in for tagged-releases

[Beanow]

Over at #1514 (comment)
I suggested adding deploy: false to be less surprising with the tags we're pushing to DockerHub.
As mentioned in #1512, we actually need deploy: true to log in with DockerHub.

Test plan:
Compare with a push to master, to see our credentials are correct for pushing :dev.
https://circleci.com/gh/sourcecred/sourcecred/4422

With the tagged deploy.
https://circleci.com/gh/sourcecred/sourcecred/4426

[vsoch]

I think this would resolve the issue!

[Beanow]

@vsoch from #1512 (comment)

Indeed if we use the orb and put deploy to false it won't log us in, but we need to do that to have more explicit control about the pushes. Why not just add:

docker login -u "${DOCKER_LOGIN}" -p "${DOCKER_PASSWORD}" docker.io

If deploy is true, then we would just be pushing sourcecred/sourcecred:latest, so I think you could set deploy to true instead and then manually just push the custom tag. If you think it's unclear for the developer, we could add a note (comment) about that.

You're right we can use either option there.
In this case I'm pushing :latest twice. Once explicitly and once from the orb.

Open to suggestions from @decentralion if one would be preferable / less confusing. 😃
For now just want to make sure it works.

[vsoch]

It's redundant to have it push twice (with deploy as true and then the manual line) but I think it's actually okay because it's more transparent for the developer. There isn't actually any issue with doing the push twice because the layers will already be found to exist and won't be pushed again. Solid and quick work, @Beanow !