Fix Docker CI: use GITHUB_TOKEN for GHCR login

[fakebizprez]

Problem

The Docker build workflow has never run successfully — all 3 historical runs failed at the GHCR login step with ##[error]Password required. The step referenced secrets.GHCR_PAT, which was never added to the repo (only DOCKERHUB_USERNAME/DOCKERHUB_TOKEN exist). Because no image was ever pushed by CI, production is serving a stale, manually-built image (the old viz).

Fix

• Authenticate to ghcr.io with the built-in GITHUB_TOKEN instead of the missing GHCR_PAT. The job already grants packages: write, so no PAT secret is needed.
• Bump actions/checkout v4 → v5 to clear the Node 20 deprecation warning.

Validation

• YAML parses cleanly.
• On this PR, the workflow runs but push: false for pull requests, so it's a safe dry run of the login/build (no image shipped until merged to master).

Notes (not addressed here)

• This builds master's Streamlit app1.py. The Taipy rewrite on refactor/streamlit-to-taipy is a separate, unmerged change.
• Production must still pull the new latest after merge (verify host auto-redeploys).
• Docker Hub login runs for the first time post-fix; watch that step in case those secrets need attention.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the Docker image build-and-push workflow to use newer automation actions and a simpler registry login method.

[coderabbitai]

Warning

Review limit reached

@fakebizprez, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 53 minutes and 11 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6fc6e591-723c-459b-af6e-b1343eb5cf7d

📥 Commits

Reviewing files that changed from the base of the PR and between e8f06a7 and 303227e.

📒 Files selected for processing (1)

• .github/workflows/docker-image.yml

📝 Walkthrough

Walkthrough

The Docker image workflow is updated to use actions/checkout@v5 and switches GHCR authentication from github.repository_owner with a GHCR_PAT secret to github.actor with the built-in GITHUB_TOKEN.

Docker CI Workflow

Layer / File(s)	Summary
Checkout version and GHCR login credentials .github/workflows/docker-image.yml	actions/checkout bumped to v5; GHCR login username changed to github.actor and password changed to secrets.GITHUB_TOKEN replacing secrets.GHCR_PAT.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

A bunny hops to version five,
No PAT needed to stay alive!
The actor logs in with a token so bright,
The workflow hums along just right.
🐇✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main workflow fix: switching GHCR login to GITHUB_TOKEN in Docker CI.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ghcr-login-github-token

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/docker-image.yml (1)

24-25: 🔒 Security & Privacy | 🔵 Trivial

Pin action to a commit hash and disable credential persistence.

The actions/checkout step uses a floating version tag (@v5) and leaves Git credentials persisted in the job environment. Per zizmor:

• unpinned-uses: Pin to a specific commit SHA to mitigate supply-chain risks.
• artipacked: Add persist-credentials: false to prevent credential leakage through artifacts.

      - name: Checkout repository
        uses: actions/checkout@<commit-sha>  # v5.0.1 or verified release
        with:
          persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker-image.yml around lines 24 - 25, The Checkout
repository step is using a floating actions/checkout version and still
persisting Git credentials. Update the workflow’s actions/checkout usage to a
fixed commit SHA instead of `@v5`, and add persist-credentials: false under its
with block to match the security guidance for this job.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/docker-image.yml:
- Around line 24-25: The Checkout repository step is using a floating
actions/checkout version and still persisting Git credentials. Update the
workflow’s actions/checkout usage to a fixed commit SHA instead of `@v5`, and add
persist-credentials: false under its with block to match the security guidance
for this job.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 060aa8f2-2b5c-44dd-a2a8-b33c27c00124

📥 Commits

Reviewing files that changed from the base of the PR and between c7ed4df and e8f06a7.

📒 Files selected for processing (1)

• .github/workflows/docker-image.yml

[llamapreview]

AI Code Review by LlamaPReview

🎯 TL;DR & Recommendation

Recommendation: Approve with suggestions

This PR fixes a broken Docker CI workflow by replacing the missing GHCR_PAT secret with the built-in GITHUB_TOKEN and bumps actions/checkout to v5, resolving the login failure and clearing a deprecation warning.

🌟 Strengths

• The fix directly addresses the root cause—no new secrets required, and the CI run succeeds.
• Clean, minimal changes with no regressions introduced.

💡 Suggestions (P2)

• .github/workflows/docker-image.yml: The fix correctly replaces the missing GHCR_PAT with GITHUB_TOKEN and aligns the username, resolving the login failure without introducing regressions.

---

💡 Have feedback? We'd love to hear it in our GitHub Discussions.
✨ This review was generated by LlamaPReview Advanced, which is free for all open-source projects. Learn more.

[fakebizprez]

@coderabbitai Addressed the nitpick partially:

• ✅ Added persist-credentials: false to the checkout step — the persisted git credential is unused (the Docker push authenticates via its own GHCR/Docker Hub tokens), so this is a clean hardening.
• ⏭️ Skipped pinning actions/checkout@v5 to a commit SHA: the other five actions in this workflow (docker/*@v3, docker/*@v5) are all floating tags too. Pinning one of six is inconsistent for marginal benefit — better handled as a dedicated repo-wide pinning pass than in this focused auth fix.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@fakebizprez Sounds good — thanks for adding persist-credentials: false; that hardening makes sense here. I'm also fine deferring action SHA pinning to a dedicated repo-wide pass rather than doing it piecemeal in this focused workflow fix.

---

✏️ Learnings added

Learnt from: fakebizprez
URL: https://github.com/linehaul-ai/streamlit-network/pull/6

Timestamp: 2026-06-27T18:14:30.315Z
Learning: For GitHub Actions workflow changes in this repository, partial hardening like `persist-credentials: false` can be applied in focused PRs, but pinning action versions to commit SHAs is preferred as a dedicated repo-wide follow-up rather than pinning a single action in isolation.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

---

If you found this review helpful, would you consider giving us a shout-out on X?

Thank you for using CodeRabbit!