Skip to content

chore: migrate image registry from hkccr to ghcr.io #405

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AlinsRan wants to merge 5 commits into
base: master
Choose a base branch
from
Open

chore: migrate image registry from hkccr to ghcr.io #405

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ce3ecb4
chore: migrate image registry from hkccr to ghcr.io
AlinsRan May 7, 2026
9d8ecb6
chore: remove legacy registry login and add packages:read permission
AlinsRan May 7, 2026
138d2d4
chore: retrigger CI
AlinsRan May 7, 2026
cfce22b
Update conformance-test.yml
AlinsRan May 7, 2026
65c6747
chore: add pull-requests write permission for add-pr-comment action
AlinsRan May 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 7 additions & 11 deletions .github/workflows/conformance-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,9 @@ jobs:
CONFORMANCE_TEST_REPORT_OUTPUT: /tmp/api7-ingress-controller-conformance-report.yaml
timeout-minutes: 60
runs-on: ubuntu-latest
permissions:
packages: read
Comment on lines +38 to +39
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "1) Show current job permissions block"
rg -n -A8 -B2 '^\s*permissions:' .github/workflows/conformance-test.yml

echo
echo "2) Inspect add-pr-comment action to infer required token scopes"
fd -a 'action.y*ml' .github/actions/add-pr-comment --exec sed -n '1,220p' {}
rg -n -C3 'createComment|issues\.|pulls\.|github-script|gh api|octokit' .github/actions/add-pr-comment

Repository: api7/api7-ingress-controller

Length of output: 439

🏁 Script executed:

echo "1) Show the full conformance-test job to see all steps"
rg -n -A 150 'job: conformance-test' .github/workflows/conformance-test.yml | head -200

echo
echo "2) Search for add-pr-comment usage in all workflow files"
fd -e yml -e yaml .github/workflows --exec rg -l 'add-pr-comment' {}

echo
echo "3) List all directories under .github/actions"
fd -type d . .github/actions --maxdepth 1

echo
echo "4) Check if add-pr-comment action exists anywhere"
find .github -name '*add-pr*' -o -name '*comment*'

Repository: api7/api7-ingress-controller

Length of output: 877

🏁 Script executed:

echo "1) Show job section starting at line 36"
sed -n '36,150p' .github/workflows/conformance-test.yml

echo
echo "2) Search for add-pr-comment in the entire workflow file"
grep -n 'add-pr-comment' .github/workflows/conformance-test.yml

echo
echo "3) View the add-pr-comment action definition"
cat .github/actions/add-pr-comment/action.yml

echo
echo "4) Check what this action actually does"
head -50 .github/actions/add-pr-comment/action.yml

Repository: api7/api7-ingress-controller

Length of output: 3428

🏁 Script executed:

echo "1) List files in add-pr-comment directory"
ls -la .github/actions/add-pr-comment/

echo
echo "2) Check for action files with different extensions"
find .github/actions/add-pr-comment -type f | head -20

echo
echo "3) Read the main action file (check for .js, .sh, or index files)"
ls -la .github/actions/add-pr-comment/

Repository: api7/api7-ingress-controller

Length of output: 452

🏁 Script executed:

echo "1) Check if there are any other files in .github/actions directory"
find .github/actions -type f

echo
echo "2) Check the git status of add-pr-comment to see if files were supposed to be added"
git ls-files .github/actions/add-pr-comment/

echo
echo "3) Verify what the workflow expects from add-pr-comment parameters"
sed -n '130,140p' .github/workflows/conformance-test.yml

Repository: api7/api7-ingress-controller

Length of output: 631

Add missing contents: read permission; note that ./.github/actions/add-pr-comment has no implementation.

The job sets only packages: read, which omits the contents: read scope needed by actions/checkout@v4 at line 42. Additionally, the add-pr-comment action referenced at line 134 is an empty directory with no implementation files—the PR comment step will fail.

Suggested permissions fix 
     permissions:
+      contents: read
       packages: read
+      pull-requests: write

The add-pr-comment custom action must be implemented before the workflow can complete successfully.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
permissions:
packages: read
permissions:
contents: read
packages: read
pull-requests: write
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/conformance-test.yml around lines 38 - 39, The workflow
sets permissions only to "packages: read" but actions/checkout@v4 also requires
"contents: read", so update the permissions block to include "contents: read"
alongside "packages: read"; additionally, implement the custom action at
./.github/actions/add-pr-comment (it currently has no entrypoint or action.yml)
or remove/replace that step to avoid runtime failure—look for the workflow step
referencing actions/checkout@v4 and the step that calls
./.github/actions/add-pr-comment and either add the action metadata/entrypoint
(action.yml and implementation script) or switch to an existing marketplace
action that posts PR comments.

pull-requests: write
steps:
- name: Checkout
uses: actions/checkout@v4
Comment on lines +38 to 43
Expand All @@ -56,19 +59,12 @@ jobs:
chmod 700 get_helm.sh
./get_helm.sh

- name: Login to Registry
- name: Login to GHCR
uses: docker/login-action@v3
with:
registry: ${{ secrets.DOCKER_REGISTRY }}
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}

- name: Login to Private Registry
uses: docker/login-action@v3
with:
registry: hkccr.ccs.tencentyun.com
username: ${{ secrets.PRIVATE_DOCKER_USERNAME }}
password: ${{ secrets.PRIVATE_DOCKER_PASSWORD }}
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
Comment thread
AlinsRan marked this conversation as resolved.
Comment thread
coderabbitai[bot] marked this conversation as resolved.

- name: Build images
env:
Expand Down
11 changes: 7 additions & 4 deletions .github/workflows/e2e-test-k8s.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,9 @@ jobs:
cases_subset:
- v2
runs-on: self-hosted
permissions:
contents: read
packages: read
steps:
- name: Checkout
uses: actions/checkout@v4
Expand All @@ -58,12 +61,12 @@ jobs:
chmod 700 get_helm.sh
./get_helm.sh

- name: Login to Private Registry
- name: Login to GHCR
uses: docker/login-action@v3
with:
registry: hkccr.ccs.tencentyun.com
username: ${{ secrets.PRIVATE_DOCKER_USERNAME }}
password: ${{ secrets.PRIVATE_DOCKER_PASSWORD }}
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
Comment thread
AlinsRan marked this conversation as resolved.

- name: Launch Kind Cluster
env:
Expand Down
18 changes: 7 additions & 11 deletions .github/workflows/e2e-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,9 @@ jobs:
- webhook
fail-fast: false
runs-on: ubuntu-latest
permissions:
contents: read
packages: read
steps:
- name: Checkout
uses: actions/checkout@v4
Expand All @@ -65,19 +68,12 @@ jobs:
- name: Install ginkgo
run: make install-ginkgo

- name: Login to Registry
- name: Login to GHCR
uses: docker/login-action@v3
with:
registry: ${{ secrets.DOCKER_REGISTRY }}
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}

- name: Login to Private Registry
uses: docker/login-action@v3
with:
registry: hkccr.ccs.tencentyun.com
username: ${{ secrets.PRIVATE_DOCKER_USERNAME }}
password: ${{ secrets.PRIVATE_DOCKER_PASSWORD }}
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
Comment thread
AlinsRan marked this conversation as resolved.
Comment thread
coderabbitai[bot] marked this conversation as resolved.

- name: Build images
env:
Expand Down
18 changes: 9 additions & 9 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -202,22 +202,22 @@ kind-down:

.PHONY: kind-load-images
kind-load-images: pull-infra-images kind-load-ingress-image kind-load-adc-image
@kind load docker-image hkccr.ccs.tencentyun.com/api7-dev/api7-ee-3-gateway:dev --name $(KIND_NAME)
@kind load docker-image hkccr.ccs.tencentyun.com/api7-dev/api7-ee-dp-manager:$(DASHBOARD_VERSION) --name $(KIND_NAME)
@kind load docker-image hkccr.ccs.tencentyun.com/api7-dev/api7-ee-3-integrated:$(DASHBOARD_VERSION) --name $(KIND_NAME)
@kind load docker-image ghcr.io/api7/api7-ee-3-gateway:dev --name $(KIND_NAME)
@kind load docker-image ghcr.io/api7/api7-ee-dp-manager:$(DASHBOARD_VERSION) --name $(KIND_NAME)
@kind load docker-image ghcr.io/api7/api7-ee-3-integrated:$(DASHBOARD_VERSION) --name $(KIND_NAME)
@kind load docker-image kennethreitz/httpbin:latest --name $(KIND_NAME)
@kind load docker-image jmalloc/echo-server:latest --name $(KIND_NAME)
@kind load docker-image apache/apisix:dev --name $(KIND_NAME)
@kind load docker-image openresty/openresty:1.27.1.2-4-bullseye-fat --name $(KIND_NAME)

.PHONY: kind-load-gateway-image
kind-load-gateway-image:
@kind load docker-image hkccr.ccs.tencentyun.com/api7-dev/api7-ee-3-gateway:dev --name $(KIND_NAME)
@kind load docker-image ghcr.io/api7/api7-ee-3-gateway:dev --name $(KIND_NAME)

.PHONY: kind-load-dashboard-images
kind-load-dashboard-images:
@kind load docker-image hkccr.ccs.tencentyun.com/api7-dev/api7-ee-dp-manager:$(DASHBOARD_VERSION) --name $(KIND_NAME)
@kind load docker-image hkccr.ccs.tencentyun.com/api7-dev/api7-ee-3-integrated:$(DASHBOARD_VERSION) --name $(KIND_NAME)
@kind load docker-image ghcr.io/api7/api7-ee-dp-manager:$(DASHBOARD_VERSION) --name $(KIND_NAME)
@kind load docker-image ghcr.io/api7/api7-ee-3-integrated:$(DASHBOARD_VERSION) --name $(KIND_NAME)

.PHONY: kind-load-ingress-image
kind-load-ingress-image:
Expand All @@ -231,9 +231,9 @@ kind-load-adc-image:

.PHONY: pull-infra-images
pull-infra-images:
@docker pull hkccr.ccs.tencentyun.com/api7-dev/api7-ee-3-gateway:dev
@docker pull hkccr.ccs.tencentyun.com/api7-dev/api7-ee-dp-manager:$(DASHBOARD_VERSION)
@docker pull hkccr.ccs.tencentyun.com/api7-dev/api7-ee-3-integrated:$(DASHBOARD_VERSION)
@docker pull ghcr.io/api7/api7-ee-3-gateway:dev
@docker pull ghcr.io/api7/api7-ee-dp-manager:$(DASHBOARD_VERSION)
@docker pull ghcr.io/api7/api7-ee-3-integrated:$(DASHBOARD_VERSION)
@docker pull kennethreitz/httpbin:latest
@docker pull jmalloc/echo-server:latest
@docker pull ghcr.io/api7/adc:dev
Expand Down
4 changes: 2 additions & 2 deletions test/e2e/framework/api7_dashboard.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ func init() {
tmpl, err := template.New("values.yaml").Parse(`
dashboard:
image:
repository: hkccr.ccs.tencentyun.com/api7-dev/api7-ee-3-integrated
repository: ghcr.io/api7/api7-ee-3-integrated
pullPolicy: IfNotPresent
tag: {{ .Tag }}
extraEnvVars:
Expand All @@ -61,7 +61,7 @@ dashboard:
mountPath: /app/covdatafiles
dp_manager:
image:
repository: hkccr.ccs.tencentyun.com/api7-dev/api7-ee-dp-manager
repository: ghcr.io/api7/api7-ee-dp-manager
pullPolicy: IfNotPresent
tag: {{ .Tag }}
extraEnvVars:
Expand Down
2 changes: 1 addition & 1 deletion test/e2e/framework/manifests/dp.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,7 +181,7 @@ spec:
spec:
#serviceAccountName: ginkgo
containers:
- image: hkccr.ccs.tencentyun.com/api7-dev/api7-ee-3-gateway:dev
- image: ghcr.io/api7/api7-ee-3-gateway:dev
imagePullPolicy: IfNotPresent
env:
{{- if not .TLSEnabled }}
Expand Down
Loading