Repository navigation
Session Handoff [auto-1892]: Log the Docker Task's Build-Base Leg In to Docker Hub for #1892 #3123
Description
Next steps, in priority order
- Fix The Docker Task's Build-Base Leg Has No Docker Hub Login, So It Cannot Push a Base Image #1892. In
.github/workflows/build-docker-task.yml, give thedocker-build-basejob the same "Require Docker Hub credentials" and "Login to Docker Hub" steps thebuild-dockerjob carries, ahead of the "Run caller docker-build-base hook step", gated the way that job gates them, so a hook asked to push holds credentials. Then pass the hook thebranchandsmokevalues the core already decides multi-arch from, the shape the issue's suggested fix names, and state those inputs wherever thedocker-build-basehook contract is documented (docs/reusable-workflows.md"The Docker Family", and anyWORKFLOW.mdor catalog text describing the hook's inputs). Done looks like: the base leg logs in before its hook on a pushing run, the hook receivesbranchandsmoke, the documented hook contract matches the job, the full local gate set and test suite green, and a pull request intodevelopcarryingCloses on promotion: #1892, driven perdrive-prto merge.
External blockers
None known at pick time. A real Docker Hub push cannot be exercised from a local session, so verification is the workflow lint, the repo gate, and any existing workflow-contract tests rather than a live push.
Internal dependencies
None. The downstream repository that found this keeps its own build-base job until this ships, and dropping that job is that repository's own follow-up, not this lane's.
State
Picked from the open backlog by an unattended picker. No branch, worktree, or pull request exists for this lane yet. Re-derive: the current docker-build-base and build-docker jobs in build-docker-task.yml (the credential check and login steps, their if: gates, and the secrets the workflow declares), how build-release-task.yml forwards docker_build_base and the Docker Hub secrets, and every surface that documents the hook's inputs.
The parked decision queue
0 parked decisions on this lane.
What the last round did
Nothing yet. This is the lane's first link, created by the picker.
What not to repeat
Nothing recorded yet.
New learnings
None yet.
Activity
ptr727 commentedon Oct 16, 2026
Lane closed out, run scope develop.
Merged: #3124 into
developasddaeefb. It fixes #1892, which closes on promotion through theCloses on promotion: #1892line in that pull request's body.What changed:
build-docker-task.yml'sdocker-build-basejob now runs the same Docker Hub credential check and login asbuild-docker, before the caller's hook runs.branchandplatforms.platformsis the platform list the core resolves once, now in workflow-levelenv.docs/reusable-workflows.md"The Docker Family" states this hook contract.This lane's next steps named
smokerather thanplatforms. The local review pass found thatsmokewould make each hook re-derive a selection the file says is decided once. A composite action also reads that boolean as a string, so a hook copying the core's expression would never pick multi-arch. The issue offered the resolved platforms as an alternative, so the fix took that one.Review:
envcannot readinputs. It was declined with actionlint evidence and resolved.Filed along the way: nothing. No lesson issue.
Left for others: NxWitness can drop its own
build-basejob once this is promoted and released. That is NxWitness's own follow-up, per this lane's body.