From 39bf21cca349ab216e1b7cd60029c0a5bc97dbaa Mon Sep 17 00:00:00 2001 From: QuicksilverSlick Date: Fri, 11 Sep 2026 09:59:30 -0500 Subject: [PATCH] ci(docker): skip image builds on forks without their own registry The Docker image workflow publishes to ghcr.io/block/buzz unless the repo variable GHCR_IMAGE names another registry. On a fork that has not set it, every push to main and every same-repo pull request fails: the build tries to push to Block's registry, or to its build cache, and is denied. build, push-gateway-build and qualify now run only upstream, or on a fork that has set GHCR_IMAGE. The merge jobs need the builds, so they skip with them. Upstream behaviour is unchanged, and a fork that wants its own images opts in by setting the variable the workflow already reads. Co-Authored-By: Claude Opus 5 --- .github/workflows/docker.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index f48f1bc92fb..5971057d83d 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -85,6 +85,9 @@ env: jobs: build: name: Build (${{ matrix.platform }}) + # Upstream publishes to ghcr.io/block/buzz. A fork runs this only once it has set + # GHCR_IMAGE to a registry it can write to; otherwise every push would fail. + if: github.repository == 'block/buzz' || vars.GHCR_IMAGE != '' runs-on: ${{ matrix.runner }} timeout-minutes: 60 permissions: @@ -236,7 +239,9 @@ jobs: qualify: name: Qualify relay image source - if: github.event_name != 'pull_request' + # Upstream publishes to ghcr.io/block/buzz. A fork runs this only once it has set + # GHCR_IMAGE to a registry it can write to; otherwise every push would fail. + if: github.event_name != 'pull_request' && (github.repository == 'block/buzz' || vars.GHCR_IMAGE != '') runs-on: ubuntu-24.04 timeout-minutes: 70 permissions: @@ -494,6 +499,9 @@ jobs: push-gateway-build: name: Build public push gateway (${{ matrix.platform }}) + # Upstream publishes to ghcr.io/block/buzz. A fork runs this only once it has set + # GHCR_IMAGE to a registry it can write to; otherwise every push would fail. + if: github.repository == 'block/buzz' || vars.GHCR_IMAGE != '' runs-on: ${{ matrix.runner }} timeout-minutes: 60 permissions: