From 747fd817210cb13669342d493e8ba37cb7bcd8b1 Mon Sep 17 00:00:00 2001
From: Carlo D'Ambrosio <carlo@ql4b.net>
Date: Sat, 24 Oct 2026 12:25:18 +0200
Subject: [PATCH] ci: skip registry login and push on pull_request events

Dependabot PRs cannot read repo secrets, so docker/login-action failed
with 'Password required'. Guard all credential/login steps with
'if: github.event_name != pull_request' and make buildx push only on
branch pushes (build-only via cacheonly on PRs) so PRs still validate
that the Dockerfiles build.
---
 .github/workflows/build-base.yml       | 25 +++++++++++++++++++------
 .github/workflows/build-installers.yml | 23 ++++++++++++++++-------
 2 files changed, 35 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/build-base.yml b/.github/workflows/build-base.yml
index 14d79f4..3efc88c 100644
--- a/.github/workflows/build-base.yml
+++ b/.github/workflows/build-base.yml
@@ -30,22 +30,35 @@ jobs:
     runs-on: ubuntu-latest
     env:
       HTTP_CLI_VERSION: v1.1.0
+      # Push to GHCR only on pushes to branches, never on pull_request events.
+      # Pull requests (especially Dependabot's) cannot read the repo secrets
+      # needed to authenticate, so they build for validation only.
+      PUSH: ${{ github.event_name != 'pull_request' }}
     steps:
       - uses: actions/checkout@v4
-      
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-        
+
       - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GHCR_PAT }}
-          
+
       - name: Build and push base
         run: |
-          echo "${{ secrets.GHCR_PAT }}" > github_token
+          if [ "${{ env.PUSH }}" = "true" ]; then
+            echo "${{ secrets.GHCR_PAT }}" > github_token
+            OUTPUT_FLAG="--push"
+          else
+            # No secrets available on PRs; provide a dummy secret file so the
+            # --secret mount resolves, and build without pushing.
+            echo "" > github_token
+            OUTPUT_FLAG="--output=type=cacheonly"
+          fi
           docker buildx build \
             --platform linux/arm64 \
             --provenance=false \
@@ -53,7 +66,7 @@ jobs:
             --build-arg HTTP_CLI_VERSION=${{ env.HTTP_CLI_VERSION }} \
             --target base \
             --tag ghcr.io/${{ github.repository_owner }}/lambda-shell-runtime:base \
-            --push \
+            $OUTPUT_FLAG \
             .
         env:
-          GITHUB_TOKEN: ${{ secrets.GHCR_PAT }}
\ No newline at end of file
+          GITHUB_TOKEN: ${{ secrets.GHCR_PAT }}
diff --git a/.github/workflows/build-installers.yml b/.github/workflows/build-installers.yml
index 38cdb95..e50e8e4 100644
--- a/.github/workflows/build-installers.yml
+++ b/.github/workflows/build-installers.yml
@@ -20,27 +20,36 @@ jobs:
     runs-on: ubuntu-latest
     env:
       HTTP_CLI_VERSION: v1.1.0
+      # Push to registries only on pushes to branches, never on pull_request
+      # events. Pull requests (especially Dependabot's) cannot read the repo
+      # secrets needed to authenticate, so they build for validation only.
+      PUSH: ${{ github.event_name != 'pull_request' }}
     steps:
       - uses: actions/checkout@v4
-      
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-        
+
       - name: Configure AWS credentials
+        if: github.event_name != 'pull_request'
         uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: us-east-1
+
       - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GHCR_PAT }}
+
       - name: Log in to Public ECR
+        if: github.event_name != 'pull_request'
         run: aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
-          
+
       - name: Build and push installers
         run: |
           # Build awscurl-installer
@@ -50,7 +59,7 @@ jobs:
             --target awscurl-installer \
             --tag ghcr.io/${{ github.repository_owner }}/lambda-shell-runtime:awscurl-installer \
             --tag public.ecr.aws/l9f6r9f5/lambda-shell-runtime:awscurl-installer \
-            --push \
+            --${{ env.PUSH == 'true' && 'push' || 'output=type=cacheonly' }} \
             -f - . << 'EOF'
           FROM public.ecr.aws/lambda/provided:al2023 AS awscurl-installer
           RUN dnf install -y unzip python3-pip findutils && dnf clean all
@@ -59,7 +68,7 @@ jobs:
               find /tmp/awscurl -type f -name '*.pyc' -delete && \
               find /tmp/awscurl -type d -name '*.dist-info' -exec rm -rf {} +
           EOF
-          
+
           # Build awscli-installer
           docker buildx build \
             --platform linux/arm64 \
@@ -67,8 +76,8 @@ jobs:
             --target awscli-installer \
             --tag ghcr.io/${{ github.repository_owner }}/lambda-shell-runtime:awscli-installer \
             --tag public.ecr.aws/l9f6r9f5/lambda-shell-runtime:awscli-installer \
-            --push \
+            --${{ env.PUSH == 'true' && 'push' || 'output=type=cacheonly' }} \
             -f - . << 'EOF'
           FROM public.ecr.aws/lambda/provided:al2023 AS awscli-installer
           RUN dnf install -y aws-cli && dnf clean all
-          EOF
\ No newline at end of file
+          EOF