Cake.Docker => Github Actions => GHCR

[ryanande]

I have a Cake.Frosting build set up in a repo firing off via Github Actions.

Performing DockerBuild, then DockerPush to ghcr.io.
Calling DockerLogin, DockerPush, then DockerLogout

context.DockerLogin(new DockerRegistryLoginSettings
{
    Password = password,
    Username = userName
}, "ghcr.io");
context.DockerPush(packageTag);
context.DockerLogout("ghcr.io");

Username from env var GITHUB_USER and Password from GITHUB_TOKEN

It works, however...

During the build I get a warning that looks not so bueno...

WARNING! Using -*** the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /home/runner/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

I do not really want ^^ this behavior, unencrypted pwd??? Wait what?

Kicking off cake with a simple run, fwiw

- name: Run build
   run: ./build.sh

Anyone know how I can correct this and keep it from happening???
Many thanks in advanced.

[gitfool]

Use a "docker credential helper" for ghcr. I do this for aws ecr via amazon-ecr-credential-helper, not ghcr, but it's the same principle.

It looks like it's early days for such support, but you have two options:

• Try gh cli with some hacks (gist)
• Try docker-credential-github-packages; build to create a single file executable first

This would work best if you run your workflow from inside a docker container that is configured accordingly.