|
| 1 | +# Container Registry CI/CD Setup |
| 2 | + |
| 3 | +## Required Secrets |
| 4 | + |
| 5 | +To enable Docker Hub and Quay.io publishing in the CI/CD pipeline, you need to set up the following secrets in your GitHub repository: |
| 6 | + |
| 7 | +### Docker Hub Secrets |
| 8 | + |
| 9 | +#### 1. DOCKERHUB_USERNAME |
| 10 | +- Go to your repository on GitHub |
| 11 | +- Navigate to Settings → Secrets and variables → Actions |
| 12 | +- Click "New repository secret" |
| 13 | +- Name: `DOCKERHUB_USERNAME` |
| 14 | +- Value: Your Docker Hub username |
| 15 | + |
| 16 | +#### 2. DOCKERHUB_TOKEN |
| 17 | +- Log in to Docker Hub |
| 18 | +- Go to Account Settings → Security |
| 19 | +- Click "New Access Token" |
| 20 | +- Create a token with appropriate permissions (Read, Write, Delete) |
| 21 | +- Copy the generated token |
| 22 | +- Go to your GitHub repository |
| 23 | +- Navigate to Settings → Secrets and variables → Actions |
| 24 | +- Click "New repository secret" |
| 25 | +- Name: `DOCKERHUB_TOKEN` |
| 26 | +- Value: The access token you just created |
| 27 | + |
| 28 | +### Quay.io Secrets |
| 29 | + |
| 30 | +#### 3. QUAY_USERNAME |
| 31 | +- Go to your repository on GitHub |
| 32 | +- Navigate to Settings → Secrets and variables → Actions |
| 33 | +- Click "New repository secret" |
| 34 | +- Name: `QUAY_USERNAME` |
| 35 | +- Value: Your Quay.io username/organization |
| 36 | + |
| 37 | +#### 4. QUAY_TOKEN |
| 38 | +- Log in to Quay.io |
| 39 | +- Go to Account Settings → Generate Encrypted Password or Robot Accounts |
| 40 | +- Create a robot account or use an encrypted password with write permissions |
| 41 | +- Copy the generated token/password |
| 42 | +- Go to your GitHub repository |
| 43 | +- Navigate to Settings → Secrets and variables → Actions |
| 44 | +- Click "New repository secret" |
| 45 | +- Name: `QUAY_TOKEN` |
| 46 | +- Value: The robot token or encrypted password |
| 47 | + |
| 48 | +## Container Image Publishing |
| 49 | + |
| 50 | +The CI/CD pipeline will automatically publish to both registries: |
| 51 | + |
| 52 | +### On main branch pushes: |
| 53 | +- Build and push development images tagged as: |
| 54 | + - **Docker Hub**: `{username}/msgtausch:main` and `{username}/msgtausch:latest` |
| 55 | + - **Quay.io**: `quay.io/{username}/msgtausch:main` and `quay.io/{username}/msgtausch:latest` |
| 56 | + |
| 57 | +### On version tags (v*): |
| 58 | +- Build and push release images tagged as: |
| 59 | + - **Docker Hub**: |
| 60 | + - `{username}/msgtausch:v1.2.3` (exact version) |
| 61 | + - `{username}/msgtausch:1.2.3` (semver) |
| 62 | + - `{username}/msgtausch:1.2` (major.minor) |
| 63 | + - `{username}/msgtausch:1` (major only) |
| 64 | + - **Quay.io**: |
| 65 | + - `quay.io/{username}/msgtausch:v1.2.3` (exact version) |
| 66 | + - `quay.io/{username}/msgtausch:1.2.3` (semver) |
| 67 | + - `quay.io/{username}/msgtausch:1.2` (major.minor) |
| 68 | + - `quay.io/{username}/msgtausch:1` (major only) |
| 69 | + |
| 70 | +## Multi-Platform Support |
| 71 | + |
| 72 | +Images are built for: |
| 73 | +- `linux/amd64` |
| 74 | +- `linux/arm64` |
| 75 | + |
| 76 | +## Security Notes |
| 77 | + |
| 78 | +- Never commit container registry credentials to the repository |
| 79 | +- Use access tokens/robot accounts instead of passwords |
| 80 | +- Regularly rotate your access tokens and robot accounts |
| 81 | +- Set appropriate permissions on tokens (minimum required for read/write) |
| 82 | +- For Quay.io, robot accounts are recommended over personal access tokens for CI/CD |
0 commit comments