nanxun/live_recorder
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: re-login before each docker push, embed withCredentials in build stages

Browse Source 
docker push is also getting 401 (not just buildx --push), suggesting
the Harbor login token expires during long builds or there is a
credential propagation gap between the standalone Login stage and the
build stages.

Move withCredentials into each build stage and re-login immediately
before every docker push / manifest push. This gives each push
operation a fresh token.

Pipeline is now: Checkout -> Prepare Buildx -> Build API (login + build
+ push + manifest) -> Build Web (same).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
nanxun
2026-07-02 20:46:32 +08:00
co-authored by Claude Opus 4.8
parent 761041a70e
commit 06921cbb3e
1 changed files with 22 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Jenkinsfile
Vendored
+22 -17
View File
@@ -52,23 +52,6 @@ pipeline {
}
}
stage('Login Registry') {
steps {
withCredentials([
usernamePassword(
credentialsId: "${DOCKER_CREDS}",
usernameVariable: 'DOCKER_USERNAME',
passwordVariable: 'DOCKER_PASSWORD'
)
]) {
sh """
set -e
echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin
"""
}
}
}
stage('Prepare Buildx') {
steps {
sh """
@@ -96,6 +79,13 @@ pipeline {
stage('Build And Push API Image') {
steps {
withCredentials([
usernamePassword(
credentialsId: "${DOCKER_CREDS}",
usernameVariable: 'DOCKER_USERNAME',
passwordVariable: 'DOCKER_PASSWORD'
)
]) {
sh """
set -e
@@ -167,6 +157,9 @@ pipeline {
.
echo "=== Pushing \$PLAT_REF ==="
# Re-login immediately before push — Harbor tokens can be
# short-lived and expire during long QEMU builds.
echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin 2>&1 | tail -1
sudo docker push "\$PLAT_REF" 2>&1 | tail -5
sudo docker push "\$PLAT_LATEST" 2>&1 | tail -5
@@ -176,6 +169,7 @@ pipeline {
echo ''
echo "=== Creating multi-arch manifest: ${API_IMAGE_TAGGED} ==="
echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin 2>&1 | tail -1
sudo docker manifest create "${API_IMAGE_TAGGED}" \
"${API_IMAGE_TAGGED}-amd64" \
"${API_IMAGE_TAGGED}-arm64"
@@ -195,9 +189,17 @@ pipeline {
"""
}
}
}
stage('Build And Push Web Image') {
steps {
withCredentials([
usernamePassword(
credentialsId: "${DOCKER_CREDS}",
usernameVariable: 'DOCKER_USERNAME',
passwordVariable: 'DOCKER_PASSWORD'
)
]) {
sh """
set -e
@@ -267,6 +269,7 @@ pipeline {
frontend
echo "=== Pushing \$PLAT_REF ==="
echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin 2>&1 | tail -1
sudo docker push "\$PLAT_REF" 2>&1 | tail -3
sudo docker push "\$PLAT_LATEST" 2>&1 | tail -3
sudo docker rmi "\$PLAT_REF" "\$PLAT_LATEST" 2>/dev/null || true
@@ -274,6 +277,7 @@ pipeline {
echo ''
echo "=== Creating multi-arch manifest: ${WEB_IMAGE_TAGGED} ==="
echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin 2>&1 | tail -1
sudo docker manifest create "${WEB_IMAGE_TAGGED}" \
"${WEB_IMAGE_TAGGED}-amd64" \
"${WEB_IMAGE_TAGGED}-arm64"
@@ -293,6 +297,7 @@ pipeline {
}
}
}
}
post {
success {