Updated the PAT (which was my personal token) to an OAT (which is from agentcatalog)#239
Merged
Conversation
…m agentcatalog) Signed-off-by: Derek Misler <[email protected]>
docker-agent
left a comment
docker-agent
left a comment
Contributor
There was a problem hiding this comment.
Assessment: 🟡 NEEDS ATTENTION
Signed-off-by: Derek Misler <[email protected]>
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
docker-agent
left a comment
docker-agent
left a comment
Contributor
There was a problem hiding this comment.
Assessment: 🟡 NEEDS ATTENTION
This PR correctly migrates Docker Hub authentication from a personal PAT to an organization OAT, removes the README upload step, and adds environment: release to publish-agent. Key validations:
- Anthropic API key change (
env.ANTHROPIC_API_KEY_FROM_SSM): Safe —setup-credentialscallscore.setSecret()beforecore.exportVariable(), so the value is masked in logs before the step that uses it runs. docker login --username "${HUB_ORG}": Correct — Docker Hub OAT documentation specifies using the org name as the username with an OAT as the password.
One hardening gap: the notify job was not given environment: release protection alongside publish-agent, despite consuming credentials from the same ./setup-credentials action.
Sayt-0
approved these changes
Jun 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces personal access token (PAT) authentication with organization access token (OAT) from agentcatalog for Docker Hub operations. Removes the Docker Hub README upload step and updates Slack notifications to use OAT-based API key from SSM.
Changes
HUB_USER/HUB_PATsecrets toHUB_ORG/HUB_OATin the release workflowANTHROPIC_API_KEY_FROM_SSMenvironment variable instead of direct secret referenceenvironment: releaseto the release job for additional security controlsTest plan
Verify the release workflow runs successfully with the new OAT credentials and that Slack notifications are sent with the SSM-sourced API key.