ci: keep master green — skip Docker publish when secrets are absent

[widgetii]

Why

After Actions was enabled and main.yml was scoped to master, the ci (Docker publish) job now runs on every push to master — and fails at Login to DockerHub because DOCKERHUB_USERNAME/DOCKERHUB_TOKEN are not configured in this repo (gh secret list is empty). That turned master red (test and CodeQL are green; only the publish fails).

This workflow only triggers on push to master (never on pull_request), so the failure cannot appear as a PR check — it surfaces only after merge, on the master push.

Fix

Gate the publish steps on the credentials being present:

• Secrets unset (current state): the job prints a ::notice:: and succeeds without publishing → master goes green.
• Secrets set (if the maintainer adds them): logs in and pushes :latest + :${{ github.sha }} from master, exactly as before.

No image is published while secrets are absent, so nothing gets pushed to Docker Hub unintentionally.

Also corrects the now-stale main.yml description in CLAUDE.md (it is master-only since being scoped).

Alternatives (say the word)

• Add the DOCKERHUB_* secrets if you actually want to publish from this repo.
• Drop the Docker-publish workflow entirely if publishing isn't wanted here.

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Docker credentials reach every action ✓ Resolved 🐞 Bug ⛨ Security

Description

The docker job assigns both Docker Hub secrets through job-level env, making them available
beyond the credential-check and login steps. Whenever credentials are configured, the QEMU, Buildx,
login, and build-push actions all execute with those credential values in their environment,
increasing the impact of a compromised or malicious action.

Code

.github/workflows/main.yml[R13-15]

+    env:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}

Evidence

The secrets are declared on the whole docker job at lines 13-15, while the same job invokes four
external actions at lines 28-45. Only the shell check reads these environment-variable names, and
the login action already receives the secrets explicitly through its inputs, so exposing them to the
setup and build actions is unnecessary.

.github/workflows/main.yml[13-15]
.github/workflows/main.yml[19-26]
.github/workflows/main.yml[28-45]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Docker Hub credentials are assigned at job scope, so every action in the job receives them even though only the credential check and login need access.
## Fix Focus Areas
- .github/workflows/main.yml[13-15]
- .github/workflows/main.yml[19-26]
## Recommended Fix
Remove the job-level `env` block and add the same secret-backed environment variables only to the `Check DockerHub credentials` step. Keep passing the secrets directly through the login action's existing `with` inputs.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can choose which labels appear on a finding, and whether they show icons or text

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Keep master CI green when DockerHub secrets are absent

🐞 Bug fix ⚙️ Configuration changes 📝 Documentation 🕐 Less than 10 minutes

AI Description

• Detect missing DockerHub credentials before initializing the image publishing pipeline.
• Skip publishing with an explicit notice instead of failing master builds.
• Document master-only publishing and its credential requirements.

Diagram

graph TD
  A["Master push"] --> B{"Master ref?"} -->|Yes| C{"Secrets set?"}
  C -->|Yes| D["Docker setup"] --> E["Docker login"] --> F["Image publish"]
  B -->|No| G["Job skipped"]
  C -->|No| H["Skip notice"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Require DockerHub secrets

• ➕ Preserves publishing on every master push
• ➕ Avoids conditional publish steps
• ➖ Master remains red until maintainers configure valid credentials
• ➖ Makes optional artifact publishing a hard CI requirement

2. Remove Docker publishing

• ➕ Eliminates credential management and publish failures
• ➕ Simplifies the GitHub Actions configuration
• ➖ Removes automated image releases
• ➖ Requires manual publishing if Docker distribution resumes

Recommendation: Keep the conditional credential gate. It preserves automated publishing when maintainers configure DockerHub while making absent optional credentials non-fatal; removing the workflow is appropriate only if Docker distribution is intentionally discontinued.

Files changed (2) +50 / -29

Bug fix (1) +45 / -27

main.ymlSkip Docker publishing when credentials are unavailable +45/-27

Skip Docker publishing when credentials are unavailable

• Exposes DockerHub secrets to the job and adds a credential check that emits a step output. Docker setup, authentication, and publishing now run only when both credentials exist; otherwise the job reports a notice and succeeds.

.github/workflows/main.yml

Documentation (1) +5 / -2

CLAUDE.mdDocument master-only conditional Docker publishing +5/-2

Document master-only conditional Docker publishing

• Corrects the CI documentation to describe master-only Docker publishing, credential-based skipping, and the separate test workflow coverage.

CLAUDE.md