Interestingly, the last time this workflow ran successfully, it supplied username and password fields when attempting to log into Docker Hub: https://github.com/cometbft/cometbft-db/actions/runs/4283008554/jobs/7457996019#step:5:3

In this workflow run and in #42, it's not: https://github.com/cometbft/cometbft-db/actions/runs/4373643991/jobs/7652076691#step:5:2

The action is the same version, and we're still supplying the parameters in the workflow itself: https://github.com/cometbft/cometbft-db/blob/main/.github/workflows/docker.yml#L59

Not sure why it's not propagating the parameters to the action though. Could be a bug in the action?

I noticed! It's precisely why I opened this PR to see if I can manage to reproduce the CI failure in #42. Indeed it is not propagating the user/passwd parameters to the action. I can think of 2 other ways to continue debugging:

1. open a PR with changes similar as in the present PR, but which is not from an external fork of this repo, and instead it's from a regular branch in this repo.
   • then see if the CI failure persists, if it doesn't then the problem is with PRs that run from forks
2. revert the last commits to the docker.yml file and see if that helps.

1. open a PR with changes similar as in the present PR, but which is not from an external fork of this repo, and instead it's from a regular branch in this repo.
   - then see if the CI failure persists, if it doesn't then the problem is with PRs that run from forks

Did this in #46. Seems like the problem is related to the fork indeed. The user/passwd secrets get passed successfully in this PR, which is plain branch from this repo: https://github.com/cometbft/cometbft-db/actions/runs/4383442081/jobs/7673693619#step:5:2

Seems like this is the expected behavior:

• https://blog.gitguardian.com/github-actions-security-cheat-sheet/#be-extra-careful-with-the-pullrequesttarget-trigger
• solution: https://dev.to/petrsvihlik/using-environment-protection-rules-to-secure-secrets-when-building-external-forks-with-pullrequesttarget-hci