From cd7c976faab6127ca1ef9aa92af0c27b598be9b6 Mon Sep 17 00:00:00 2001
From: Leigh <351529+leighmcculloch@users.noreply.github.com>
Date: Fri, 23 Oct 2026 02:05:00 +0000
Subject: [PATCH 1/4] skip pr image push when secrets are unavailable

---
 .github/workflows/ci.yml | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3e22b1eb..fd09cd2c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,6 +50,7 @@ jobs:
       images: ${{ steps.images.outputs.images }}
       tags: ${{ steps.tags.outputs.tags }}
       archs: ${{ steps.archs.outputs.archs }}
+      has-secrets: ${{ steps.secrets.outputs.has-secrets }}
     steps:
     - uses: actions/checkout@v2
       with:
@@ -87,6 +88,15 @@ jobs:
         archs='["amd64","arm64"]'
         <<< $archs jq
         echo "archs=$archs" >> $GITHUB_OUTPUT
+    # Builds that don't have access to secrets, such as builds for pull requests
+    # from forks or opened by dependabot, are not able to push images.
+    - name: Secrets
+      id: secrets
+      env:
+        DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+      run: |
+        if [ -n "$DOCKERHUB_TOKEN" ]; then has_secrets=true; else has_secrets=false; fi
+        echo "has-secrets=$has_secrets" | tee -a $GITHUB_OUTPUT
 
   build:
     name: 2 build
@@ -117,7 +127,7 @@ jobs:
       tag: ${{ fromJSON(needs.setup.outputs.tags)[0] }}-${{ fromJSON(needs.setup.outputs.archs)[0] }}
 
   push:
-    if: ((github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
+    if: ((github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && needs.setup.outputs.has-secrets == 'true')
     name: 5 push
     needs: [setup, build]
     permissions:
@@ -140,7 +150,7 @@ jobs:
       registry_password: ${{ secrets.DOCKERHUB_TOKEN || github.token }}
 
   action-using-registry:
-    if: ((github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
+    if: ((github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && needs.setup.outputs.has-secrets == 'true')
     needs: [setup, push]
     name: 6 test action registry
     uses: ./.github/workflows/internal-action-test.yml

From 39df44c33a18e974235affe8cd3c97204476e30c Mon Sep 17 00:00:00 2001
From: Leigh <351529+leighmcculloch@users.noreply.github.com>
Date: Fri, 23 Oct 2026 02:33:08 +0000
Subject: [PATCH 2/4] inline secrets check into a one-line expression

---
 .github/workflows/ci.yml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fd09cd2c..3574bc47 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -92,11 +92,7 @@ jobs:
     # from forks or opened by dependabot, are not able to push images.
     - name: Secrets
       id: secrets
-      env:
-        DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
-      run: |
-        if [ -n "$DOCKERHUB_TOKEN" ]; then has_secrets=true; else has_secrets=false; fi
-        echo "has-secrets=$has_secrets" | tee -a $GITHUB_OUTPUT
+      run: echo "has-secrets=${{ secrets.DOCKERHUB_TOKEN != '' }}" | tee -a $GITHUB_OUTPUT
 
   build:
     name: 2 build

From 1390204b308ce5de2aa605fe2a7037c05a1af8fb Mon Sep 17 00:00:00 2001
From: Leigh <351529+leighmcculloch@users.noreply.github.com>
Date: Sun, 25 Oct 2026 11:44:16 +0000
Subject: [PATCH 3/4] skip pr image push for dependabot builds only

---
 .github/workflows/ci.yml | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3574bc47..826848d1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,7 +50,6 @@ jobs:
       images: ${{ steps.images.outputs.images }}
       tags: ${{ steps.tags.outputs.tags }}
       archs: ${{ steps.archs.outputs.archs }}
-      has-secrets: ${{ steps.secrets.outputs.has-secrets }}
     steps:
     - uses: actions/checkout@v2
       with:
@@ -88,11 +87,6 @@ jobs:
         archs='["amd64","arm64"]'
         <<< $archs jq
         echo "archs=$archs" >> $GITHUB_OUTPUT
-    # Builds that don't have access to secrets, such as builds for pull requests
-    # from forks or opened by dependabot, are not able to push images.
-    - name: Secrets
-      id: secrets
-      run: echo "has-secrets=${{ secrets.DOCKERHUB_TOKEN != '' }}" | tee -a $GITHUB_OUTPUT
 
   build:
     name: 2 build
@@ -122,8 +116,10 @@ jobs:
       artifact: image-quickstart-${{ fromJSON(needs.setup.outputs.tags)[0] }}-${{ fromJSON(needs.setup.outputs.archs)[0] }}.tar
       tag: ${{ fromJSON(needs.setup.outputs.tags)[0] }}-${{ fromJSON(needs.setup.outputs.archs)[0] }}
 
+  # Pull requests from forks, and builds triggered by dependabot, don't have
+  # access to secrets and so are not able to push images.
   push:
-    if: ((github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && needs.setup.outputs.has-secrets == 'true')
+    if: ((github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
     name: 5 push
     needs: [setup, build]
     permissions:
@@ -146,7 +142,7 @@ jobs:
       registry_password: ${{ secrets.DOCKERHUB_TOKEN || github.token }}
 
   action-using-registry:
-    if: ((github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && needs.setup.outputs.has-secrets == 'true')
+    if: ((github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
     needs: [setup, push]
     name: 6 test action registry
     uses: ./.github/workflows/internal-action-test.yml

From 40f71eb6fdfcb2129c0f7f3101f67b8206881c5b Mon Sep 17 00:00:00 2001
From: Leigh <351529+leighmcculloch@users.noreply.github.com>
Date: Sun, 25 Oct 2026 15:20:20 +0000
Subject: [PATCH 4/4] remove push job secrets comment

---
 .github/workflows/ci.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 826848d1..82103725 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -116,8 +116,6 @@ jobs:
       artifact: image-quickstart-${{ fromJSON(needs.setup.outputs.tags)[0] }}-${{ fromJSON(needs.setup.outputs.archs)[0] }}.tar
       tag: ${{ fromJSON(needs.setup.outputs.tags)[0] }}-${{ fromJSON(needs.setup.outputs.archs)[0] }}
 
-  # Pull requests from forks, and builds triggered by dependabot, don't have
-  # access to secrets and so are not able to push images.
   push:
     if: ((github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
     name: 5 push