Gergő Magyar ac9246cfd3 ci(docker): mirror signed images to Docker Hub alongside GHCR (#1029) ... * ci(docker): mirror signed images to Docker Hub alongside GHCR docker.yml now publishes to docker.io/abhigyanpatwari/gitnexus{,-web} in the same build step as the existing GHCR push, so both registries receive the same digest, the same Cosign keyless signature, and the same SBOM / build-provenance attestations. The Docker Hub login uses new repo secrets DOCKERHUB_USERNAME / DOCKERHUB_TOKEN (scoped PAT, not account password). Supply-chain guarantees carry over unchanged: the signing loop iterates metadata-action's full tag set, so Docker Hub tags get signed at the identical digest under the same docker.yml@refs/tags/v* identity. The ClusterImagePolicy is extended with docker.io / index.docker.io / bare- namespace globs so admission cannot be sidestepped by registry-prefix choice. README and .env.example document both registries; RC section in CONTRIBUTING.md notes the Docker Hub mirror tag. Closes #1027 * ci(docker): publish to akonlabs Docker Hub namespace; add PR dry-run CI - Hardcode `akonlabs` as the Docker Hub namespace in metadata-action and both attestation subject-names (Docker Hub org differs from GitHub org `abhigyanpatwari`, so `github.repository_owner` would produce the wrong ref) - Update docs (.env.example, README, CONTRIBUTING) and the Kubernetes ClusterImagePolicy globs to reference `akonlabs/gitnexus{,-web}` - Add `pull_request` trigger so the image build runs as CI on every PR (build only — no push, sign, or attestation) - Add `workflow_dispatch` with `dry_run: boolean` (default true) for manual build-only runs; all publish steps gated on `github.event_name != 'pull_request' && !inputs.dry_run`		2026-04-23 18:59:26 +01:00
..
kubernetes	ci(docker): mirror signed images to Docker Hub alongside GHCR (#1029)	2026-04-23 18:59:26 +01:00