Skip to content

Remove dependency on docker/login-action #3363

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zsy056 wants to merge 1 commit into
base: master
Choose a base branch
from
+41 −9
Open

Remove dependency on docker/login-action #3363

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 41 additions & 9 deletions .github/workflows/msvc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,11 @@ concurrency:

permissions:
contents: read
packages: write
Copy link
Contributor

@kpumuk kpumuk Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Global write permission is considered a security risk. I would recommend to move it down to a specific job that needs write permissions.

See https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions


jobs:
build:
runs-on: windows-2025
if: false # currently broken -> see THRIFT-5936
env:
THRIFT_BUILD_DIR: C:\thrift-build

Expand All @@ -36,6 +36,20 @@ jobs:
run: |
New-Item -Path $env:THRIFT_BUILD_DIR -ItemType Directory -Force | Out-Null

- name: Configure Docker credential store
shell: pwsh
run: |
$dockerConfig = Join-Path $env:RUNNER_TEMP 'docker-config'
New-Item -Path $dockerConfig -ItemType Directory -Force | Out-Null

if (-not (Get-Command 'docker-credential-wincred.exe' -ErrorAction SilentlyContinue)) {
Write-Error 'docker-credential-wincred.exe is not available on this runner'
exit 1
}

'{"credsStore":"wincred"}' | Out-File -FilePath (Join-Path $dockerConfig 'config.json') -Encoding ascii
"DOCKER_CONFIG=$dockerConfig" | Out-File -FilePath $env:GITHUB_ENV -Append

- name: Set Docker image name
shell: pwsh
env:
Expand All @@ -52,22 +66,32 @@ jobs:

- name: Log in to GHCR
if: github.event_name != 'pull_request'
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
shell: pwsh
env:
GHCR_USERNAME: ${{ github.actor }}
GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
$env:GHCR_TOKEN | docker login ghcr.io --username $env:GHCR_USERNAME --password-stdin
if ($LASTEXITCODE -ne 0) {
Write-Error "Failed to log in to GHCR"
exit 1
}

- name: Pull cached image
id: pull_cached
continue-on-error: true
timeout-minutes: 10
timeout-minutes: 40
shell: pwsh
run: |
$needBuild = $true

Write-Host "Attempting to pull hash-based tag: $($env:DOCKER_IMAGE):$($env.IMAGE_TAG)"
$output = docker pull "$($env.DOCKER_IMAGE):$($env.IMAGE_TAG)" 2>&1
if ([string]::IsNullOrWhiteSpace($env:DOCKER_IMAGE) -or [string]::IsNullOrWhiteSpace($env:IMAGE_TAG)) {
Write-Error "DOCKER_IMAGE or IMAGE_TAG is empty. DOCKER_IMAGE='$env:DOCKER_IMAGE' IMAGE_TAG='$env:IMAGE_TAG'"
exit 1
}

Write-Host "Attempting to pull hash-based tag: $($env:DOCKER_IMAGE):$($env:IMAGE_TAG)"
$output = docker pull "$($env:DOCKER_IMAGE):$($env:IMAGE_TAG)" 2>&1
$output | Out-Host

if ($LASTEXITCODE -eq 0) {
Expand Down Expand Up @@ -147,3 +171,11 @@ jobs:
name: msvc-LastTest-log
path: ${{ env.THRIFT_BUILD_DIR }}\Testing\Temporary\LastTest.log
if-no-files-found: warn

- name: Remove Docker credential store
if: always()
shell: pwsh
run: |
if (-not [string]::IsNullOrWhiteSpace($env:DOCKER_CONFIG) -and (Test-Path $env:DOCKER_CONFIG)) {
Remove-Item $env:DOCKER_CONFIG -Recurse -Force
}