From 603cca48d2f49bb186504daa41b24501796f61a4 Mon Sep 17 00:00:00 2001
From: Carlo D'Ambrosio <carlo@ql4b.net>
Date: Sat, 24 Oct 2026 13:06:04 +0200
Subject: [PATCH] ci: skip registry login and push on pull_request in
 build-and-release

The Build and Release workflow runs on every PR (no paths filter) and its
build-base job logged into GHCR and Public ECR unconditionally, so
Dependabot PRs failed with 'Password required' before any build ran.

Guard all login/credential steps in both the build-base and build jobs
with 'if: github.event_name != pull_request', and make build-base push
only on branch pushes (cacheonly on PRs). The build job already builds
--load without pushing on PRs. Mirrors the fix applied to build-base.yml
and build-installers.yml in #18.
---
 .github/workflows/build-and-release.yml | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-and-release.yml b/.github/workflows/build-and-release.yml
index cb291e7..84a84a5 100644
--- a/.github/workflows/build-and-release.yml
+++ b/.github/workflows/build-and-release.yml
@@ -24,27 +24,42 @@ jobs:
     runs-on: ubuntu-latest
     env:
       HTTP_CLI_VERSION: v1.1.0
+      # Push to registries only on pushes to branches, never on pull_request
+      # events. Pull requests (especially Dependabot's) cannot read the repo
+      # secrets needed to authenticate, so they build for validation only.
+      PUSH: ${{ github.event_name != 'pull_request' }}
     steps:
       - uses: actions/checkout@v3
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GHCR_PAT }}
       - name: Configure AWS credentials
+        if: github.event_name != 'pull_request'
         uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: us-east-1
       - name: Log in to Public ECR
+        if: github.event_name != 'pull_request'
         run: aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
       - name: Build and push base
         run: |
-          echo "${{ secrets.GHCR_PAT }}" > github_token
+          if [ "${{ env.PUSH }}" = "true" ]; then
+            echo "${{ secrets.GHCR_PAT }}" > github_token
+            OUTPUT_FLAG="--push"
+          else
+            # No secrets available on PRs; dummy secret file so the --secret
+            # mount resolves, and build without pushing.
+            echo "" > github_token
+            OUTPUT_FLAG="--output=type=cacheonly"
+          fi
           docker buildx build \
             --platform linux/arm64,linux/amd64 \
             --provenance=false \
@@ -53,7 +68,7 @@ jobs:
             --target base \
             --tag ghcr.io/${{ github.repository_owner }}/lambda-shell-runtime:base \
             --tag public.ecr.aws/l9f6r9f5/lambda-shell-runtime:base \
-            --push \
+            $OUTPUT_FLAG \
             .
         env:
           GITHUB_TOKEN: ${{ secrets.GHCR_PAT }}
@@ -119,14 +134,17 @@ jobs:
           fi
           echo "Detected VERSION: $VERSION"
       - name: Configure AWS credentials
+        if: github.event_name != 'pull_request'
         uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: us-east-1
       - name: Log in to GHCR
+        if: github.event_name != 'pull_request'
         run: echo "${{ secrets.GHCR_PAT }}" | docker login ghcr.io -u skunxicat --password-stdin
       - name: Log in to Public ECR
+        if: github.event_name != 'pull_request'
         run: aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
       - name: Build and push images
         run: |