feat(release): dual-push Flatpak OCI layouts to Docker Hub (#178)

* feat(release): dual-push Flatpak OCI layouts to Docker Hub

* fix(release): derive Docker Hub repo name from REGISTRY

.github/workflows/release.yml

@@ -118,6 +118,12 @@ on:
       # every Linux package format, the Flatpak bundle's commit and OCI image, and SHA256SUMS.txt.
       LINUX_SIGNING_KEY:
         required: false
+      DOCKERHUB_USERNAME:
+        description: "Username for publishing Flatpak OCI layouts to Docker Hub"
+        required: false
+      DOCKERHUB_TOKEN:
+        description: "Personal access token for publishing Flatpak OCI layouts to Docker Hub"
+        required: false
 
     outputs:
       version:
@@ -574,13 +580,15 @@ jobs:
           tarball="${tarballs[0]}"
           packaging/linux/flatpak-bundle.sh "$tarball"
           printf 'tarball=%s\n' "$tarball" >> "$GITHUB_OUTPUT"
-      - name: Publish Flatpak OCI layout to GHCR
+      - name: Publish Flatpak OCI layout to GHCR and Docker Hub
         if: github.event_name != 'pull_request'
         env:
           RELEASE_VERSION: ${{ needs.version.outputs.version }}
           ARCH: ${{ matrix.arch }}
           REGISTRY: ghcr.io/${{ github.repository }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
           TARBALL: ${{ steps.flatpak_bundle.outputs.tarball }}
         run: |
           if [ -x packaging/linux/flatpak-oci.sh ]; then
@@ -609,6 +617,19 @@ jobs:
             # signature lookaside, and the release keeps it so the digest can be checked.
             skopeo inspect --raw --creds "$creds" \
               "docker://$REGISTRY:$RELEASE_VERSION-$ARCH" >"dist/release/$base.oci-manifest.json"
+
+            if [ -n "${DOCKERHUB_USERNAME:-}" ] && [ -n "${DOCKERHUB_TOKEN:-}" ]; then
+              dh_registry="docker.io/storytold/${REGISTRY##*/}"
+              dh_creds="$DOCKERHUB_USERNAME:$DOCKERHUB_TOKEN"
+              echo "==> Pushing to $dh_registry:$RELEASE_VERSION-$ARCH"
+              skopeo copy --format oci --dest-creds "$dh_creds" "oci:$layout" "docker://$dh_registry:$RELEASE_VERSION-$ARCH"
+              if [[ "$RELEASE_VERSION" != *-* && "$GITHUB_REF" == refs/heads/release ]]; then
+                echo "==> Pushing to $dh_registry:stable-$ARCH"
+                skopeo copy --format oci --dest-creds "$dh_creds" "oci:$layout" "docker://$dh_registry:stable-$ARCH"
+              else
+                echo "Leaving $dh_registry:stable-$ARCH unchanged: $RELEASE_VERSION from $GITHUB_REF is not a stable release-branch build"
+              fi
+            fi
           fi
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:

README.md

@@ -95,7 +95,9 @@ somewhere users can check it independently. On first install, compare that finge
 The workflow pushes the Flatpak OCI image itself: the app's `packaging/linux/flatpak-oci.sh` only
 builds the layout. Every run except a pull request pushes `ghcr.io/<repo>:<version>-<arch>`; only a
 stable version built from the `release` branch also moves `stable-<arch>`, whatever the app's copy
-of the script does with `--push`.
+of the script does with `--push`. When `DOCKERHUB_USERNAME` and `DOCKERHUB_TOKEN` are configured
+(e.g. as organization secrets), the job dual-pushes the OCI layout to `docker.io/storytold/<app>`
+with the same version and stable architecture tags.
 
 The key must sign without a passphrase. Keep the primary key offline and store only a signing
 subkey:

tests/test_release_flatpak_oci.py

@@ -11,7 +11,7 @@ import yaml
 
 ROOT = Path(__file__).resolve().parents[1]
 WORKFLOW = yaml.load((ROOT / ".github/workflows/release.yml").read_text(), Loader=yaml.BaseLoader)
-STEP = next(step for step in WORKFLOW["jobs"]["flatpak"]["steps"] if step.get("name") == "Publish Flatpak OCI layout to GHCR")
+STEP = next(step for step in WORKFLOW["jobs"]["flatpak"]["steps"] if step.get("name") == "Publish Flatpak OCI layout to GHCR and Docker Hub")
 BASH = shutil.which("bash")
 
 # An app's flatpak-oci.sh as most apps still carry it: --push also moves stable-<arch>. It records
@@ -101,6 +101,26 @@ class FlatpakOciPublishTests(unittest.TestCase):
     def test_the_step_never_runs_for_a_pull_request(self):
         self.assertEqual(STEP.get("if"), "github.event_name != 'pull_request'")
 
+    def test_dockerhub_credentials_trigger_dual_push_for_stable_release(self):
+        result = self.publish("1.2.0", "refs/heads/release", DOCKERHUB_USERNAME="user", DOCKERHUB_TOKEN="secret")
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        log = self.log.read_text()
+        self.assertIn("docker://ghcr.io/storytold/democraft:1.2.0-x86_64", log)
+        self.assertIn("docker://ghcr.io/storytold/democraft:stable-x86_64", log)
+        self.assertIn("docker://docker.io/storytold/democraft:1.2.0-x86_64", log)
+        self.assertIn("docker://docker.io/storytold/democraft:stable-x86_64", log)
+        self.assertIn("--dest-creds user:secret", log)
+
+    def test_dockerhub_credentials_trigger_dual_push_for_prerelease(self):
+        result = self.publish("1.2.0-rc.1", "refs/heads/release", DOCKERHUB_USERNAME="user", DOCKERHUB_TOKEN="secret")
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        log = self.log.read_text()
+        self.assertIn("docker://ghcr.io/storytold/democraft:1.2.0-rc.1-x86_64", log)
+        self.assertNotIn("docker://ghcr.io/storytold/democraft:stable-x86_64", log)
+        self.assertIn("docker://docker.io/storytold/democraft:1.2.0-rc.1-x86_64", log)
+        self.assertNotIn("docker://docker.io/storytold/democraft:stable-x86_64", log)
+        self.assertIn("Leaving docker.io/storytold/democraft:stable-x86_64 unchanged", result.stdout)
+
 
 if __name__ == "__main__":
     unittest.main()