From 56b46bcba2a7e6649cbbbc5a17837cb075beb13a Mon Sep 17 00:00:00 2001 From: Nathan Broadbent Date: Tue, 13 Oct 2026 16:32:27 +1300 Subject: [PATCH] ci: scan the public gateway image without Docker Hub credentials The image repository is public now, so the nightly image scan pulls it anonymously. The scan job no longer has access to the Docker Hub token, which can push images; only the Release workflow uses it. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/security-scan.yml | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index 5e7cda98..af5345e1 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -53,13 +53,7 @@ jobs: image-scan: runs-on: ubuntu-24.04 steps: - # The image repository needs a login to pull. - - name: Log in to Docker Hub - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 - with: - username: ${{ secrets.DOCKER_HUB_USERNAME }} - password: ${{ secrets.DOCKER_HUB_TOKEN }} - + # The image is public, so the scan pulls it without Docker Hub credentials. - name: Scan the published gateway image uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: