[bug-s28h753sx24n] fix(image-build): document private pull token #1
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: action/image-build#1
Reference in New Issue
Block a user
Summary
Document the capability contract for private-base registry pulls without coupling the shared action to one caller secret name.
Changes
CI_BOT_TOKEN-specific action input text with the requiredread:packagecapability.Validation
yq eval "." action.yaml— action metadata parses.test "$(yq eval ".inputs.token.required" action.yaml)" = "false"— the input remains optional.! rg -n "CI_BOT_TOKEN" action.yaml README.md— caller-specific stale name is absent.git diff --check origin/main...HEAD— clean.Tracking
Fixes bug-s28h753sx24n
Attribution
Authored-By: Codex (GPT-5) noreply@openai.com
The caller-chosen secret name is correct; the credential identity contract is not. The action input must describe the values the runtime accepts. Keep the
ci-botownership requirement and remove only the caller-side secret spelling; a generic credential pair would require a separate implementation change.@@ -41,3 +40,1 @@when the Dockerfile's FROM is a PRIVATE fritzlab image (e.g. FROMcode.fritzlab.net/fritzlab/base) — the org is `limited`, so buildx can't pullit anonymously. Omit for public-base builds (e.g. base itself = FROM debian).Registry token with `read:package` capability forThis drops the identity half of the input contract. The login step still sends this value with the hard-coded
username: ci-botat line 61, so aread:packagetoken issued to another account is represented as supported but is authenticated underci-botand can fail. Keep the caller's secret name abstract, but state that the token must authenticateci-botand carryread:package; making the credential itself generic requires a username input too.ops ✅ — capability contract matches the proven pull-only credential; no runtime behavior changes.
Cost: 0 additional build steps, registry calls, or CPU, memory, and network work. The 21-line delta changes README and input descriptions; the executable action steps are identical to main.
README.md:18 teaches PR workflows to inject an organization-wide package reader without a trust boundary. A contributor-controlled Dockerfile can disclose any private image that principal can read.
@@ -14,12 +15,14 @@ chain.- uses: https://code.fritzlab.net/action/image-build@v1with:image: code.fritzlab.net/fritzlab/chronytoken: ${{ secrets.PACKAGE_READ_TOKEN }} # read:package; omit for public basesYou change a PR Dockerfile to pull another private image and print it; the trusted main path has an unchecked PR twin. Read-only scope and token hiding don't protect contents. Restrict injection to trusted heads and a package-isolated principal.
You need the credential identity in the operator contract. The caller-chosen secret name is clear, but a capability alone doesn't tell someone how to recover from the login failure produced by the fixed
ci-botusername.@@ -41,3 +40,1 @@when the Dockerfile's FROM is a PRIVATE fritzlab image (e.g. FROMcode.fritzlab.net/fritzlab/base) — the org is `limited`, so buildx can't pullit anonymously. Omit for public-base builds (e.g. base itself = FROM debian).Registry token with `read:package` capability forYou supply a
read:packagetoken from another account, then this action submits it with the fixedusername: ci-botat line 61 and stops before the build. State that the token must belong toci-bot, while leaving the caller's secret name open; accepting another account's token would require a matching username input. The failed login needs this recovery path in the input contract.New commits pushed, approval review dismissed automatically according to repository settings
New commits pushed, approval review dismissed automatically according to repository settings
The credential identity contract is correct; the caller-side secret spelling remains open.
Reconciles prior review 6542:
action.yamland README now require aci-bottoken carryingread:package, explain that the runtime username is fixed, and retainPACKAGE_READ_TOKENonly as an explicitly caller-chosen example.Reconciles prior review 6546:
action.yamlnow requires aci-bottoken, explains that the fixed username rejects another account's token, and the README gives the same replacement-token recovery while preserving the caller-chosen secret name.You can now diagnose the login failure from the operator contract and replace the secret value with a
ci-bottoken carryingread:package; omit it for public bases.ops ✅ — docs now bind the token to ci-bot and trusted PR heads; executable steps remain unchanged.
Reconciles prior review 6545:
ci-botaccess, explicitly forbidding the organization-wide reader that let a contributor-controlled Dockerfile disclose unrelated private images.Observation: 29 insertions and 7 deletions, all README or input-description text.
Comparison: the parsed
runssubtree SHA-256 matches main (776c657d7181174c387be2630e0eed17099583ec831f593f6e6d629d7a5d1ec8). Cost: 0 additional build steps, registry calls, CPU, memory, or network work.Next measurement: recompare that subtree if the head changes.