Verify resources: authenticate Docker Hub image checks
What does this MR do?
Authenticates the Docker Hub image checks in mage resources:verifyAll
(magefiles/build/checker.go), which are currently done unauthenticated
and hit Docker Hub'''s anonymous pull rate limit.
Why was this MR needed?
verify stable resources / verify bleeding edge resources check
roughly 160 Docker Hub tags per run via unauthenticated skopeo inspect
calls. Docker Hub'''s anonymous limit is 100 pulls/6h per IP, so this job
exceeds the limit on its own, regardless of any other traffic sharing the
runner'''s IP - see the linked issue for a real failing job.
This attaches DOCKER_HUB_USER/DOCKER_HUB_PASSWORD (already used to
push these images in .gitlab/ci/release.gitlab-ci.yml) the same way
CI_REGISTRY_USER/CI_REGISTRY_PASSWORD are already attached for
registry.gitlab.com images, keeping both credential sets mutually
exclusive per registry (see MR history note below).
What are the relevant issue numbers?
Notes for reviewers
This credential-attach logic has caused one prior regression:
!5906 (merged) attached
GitLab.com credentials to every image check unconditionally, which broke
Docker Hub checks with 401s; fixed by
!5914 (merged) by scoping
credentials to registry.gitlab.com only. This MR adds a second, equally
scoped switch case for Docker Hub, and a new checker_test.go with
table-driven tests asserting credentials never cross registries, to guard
against a repeat of that failure mode.
Still needs verification before merge: confirm DOCKER_HUB_USER/
DOCKER_HUB_PASSWORD are actually exposed to the verify bleeding edge resources/verify stable resources jobs (their protection/environment
scope isn'''t visible from the repo). Marked draft until that'''s confirmed
against a real pipeline run.