Skip to content

fix(ci): use DEV registry password for DEV registry login in prod build#104

Merged
duckhawk merged 1 commit into
mainfrom
fix/build-prod-dev-registry-password
Jul 13, 2026
Merged

fix(ci): use DEV registry password for DEV registry login in prod build#104
duckhawk merged 1 commit into
mainfrom
fix/build-prod-dev-registry-password

Conversation

@duckhawk

Copy link
Copy Markdown
Member

Description

The prod build (.github/workflows/build_prod.yml) has two modules-actions/setup@v4 login steps per job: the first logs into the PROD registry, the second into the DEV registry (registry: ${{ vars.DEV_REGISTRY }}, registry_login: ${{ vars.DEV_MODULES_REGISTRY_LOGIN }}).

The second (DEV) step was passing the PROD password:

registry_password: ${{ secrets.PROD_MODULES_REGISTRY_PASSWORD }}   # wrong for the DEV registry

This changes it back to the DEV password in all editions (ce/ee/fe/se/se-plus):

registry_password: ${{ secrets.DEV_MODULES_REGISTRY_PASSWORD }}

The build step keeps the PROD credentials — those are correct because module_source points to the PROD registry.

Why do we need it, and what problem does it solve?

The mismatch was introduced together with the VEX attestation change. Logging into the DEV registry with the PROD password fails (werf cr login … unauthorized: Auth failed), which breaks the prod build for every edition on tag builds. The DEV registry is the secondary_repo push target, so a valid DEV login is required.

The same defect was observed and fixed in csi-ceph (deckhouse/csi-ceph#189), where it broke the v0.5.30 release build.

What is the expected result?

A tagged prod build logs into both the PROD and DEV registries successfully and builds/pushes the module images for every edition.

Checklist

  • The code is covered by unit tests.
  • e2e tests passed.
  • Documentation updated according to the changes.
  • Changes were tested in the Kubernetes cluster manually.

The second modules-actions/setup step in build_prod.yml logs into the DEV
registry (registry: DEV_REGISTRY, registry_login: DEV_MODULES_REGISTRY_LOGIN)
but was passing PROD_MODULES_REGISTRY_PASSWORD, so 'werf cr login' to the DEV
registry would fail with 'unauthorized: Auth failed' and break the prod build
for every edition (ce/ee/fe/se/se-plus).

Restore the DEV registry password for that login step. The build step keeps
the PROD credentials, which are correct because module_source is the PROD
registry.

Signed-off-by: v.oleynikov <vasily.oleynikov@flant.com>
@NikolayDemchuk
NikolayDemchuk self-requested a review July 13, 2026 14:16
@duckhawk
duckhawk merged commit 19c1249 into main Jul 13, 2026
12 of 13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants