From fc7498fef0a266e4c96c890fde6dc962f8038e74 Mon Sep 17 00:00:00 2001 From: core-fe Date: Thu, 21 May 2026 10:37:48 -0700 Subject: [PATCH] fix(ci): isolate publish buildx docker config --- .gitea/workflows/publish-workspace-server-image.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.gitea/workflows/publish-workspace-server-image.yml b/.gitea/workflows/publish-workspace-server-image.yml index 4f182d5c9..cd365f2b7 100644 --- a/.gitea/workflows/publish-workspace-server-image.yml +++ b/.gitea/workflows/publish-workspace-server-image.yml @@ -135,6 +135,18 @@ jobs: run: | echo "sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT" + # Keep Buildx state inside the job temp dir. The publish runner's + # inherited DOCKER_CONFIG can point at a host-owned ECR config path + # (/home/hongming/.docker-ecr), which caused setup-buildx-action to + # fail before image build with EACCES creating buildx/certs. + - name: Prepare writable Docker config + run: | + set -euo pipefail + export DOCKER_CONFIG="$RUNNER_TEMP/docker-config" + mkdir -p "$DOCKER_CONFIG/buildx/certs" + echo "DOCKER_CONFIG=$DOCKER_CONFIG" >> "$GITHUB_ENV" + docker buildx version + # Build + push platform image (inline ECR auth — mirrors the operator-host # approach; credentials come from GITHUB_SECRET_AWS_ACCESS_KEY_ID / # GITHUB_SECRET_AWS_SECRET_ACCESS_KEY in Gitea Actions). -- 2.52.0