From 939612f089fdf485f57c5e0876bb3193018c217d Mon Sep 17 00:00:00 2001 From: Felix Faerber Date: Thu, 20 Aug 2026 12:40:45 +0300 Subject: [PATCH] deploy: log out of ghcr, so a dead token stops breaking later pulls GITHUB_TOKEN expires with the workflow run, but `docker login` writes it to /root/.docker/config.json on the host, where it stays. Docker then presents that dead token on every subsequent pull and does NOT fall back to anonymous, so even a public image fails with "No such image" -- which reads as a missing image rather than a stale credential. This broke deploys of services that have nothing to do with this workflow. The workaround each time was to delete the ghcr.io auth entry by hand, pull, and restore it; the stale entry has now been removed from the host as well. Uses a trap on EXIT rather than a trailing command so the logout also runs when a pull or a stack deploy fails -- the failure case is exactly when a half-finished run would otherwise leave the credential behind. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01YLYiaPYror1vLKApYKrxTu --- .github/workflows/deploy.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 1973107..d1f7c7f 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -17,6 +17,18 @@ jobs: host: ${{ secrets.SSH_KNOWN_HOSTS }} key: ${{ secrets.SSH_PRIV_KEY }} script: | + # Always log out, including when a pull or deploy below fails. + # + # GITHUB_TOKEN dies with the workflow run, but `docker login` + # persists it to /root/.docker/config.json on the HOST, where it + # outlives the run by however long until someone notices. Docker + # then presents that dead token on every later pull and does NOT + # fall back to anonymous, so even a public image fails with + # "No such image" — which reads like the image is missing rather + # than like the credential is stale. Deploys of unrelated services + # broke this way, and the workaround each time was to delete the + # ghcr.io entry by hand, pull, and put it back. + trap 'docker logout ghcr.io >/dev/null 2>&1 || true' EXIT cd ~/devops && git pull echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin docker pull ghcr.io/token-for-token/hosted-gateway:main