Repository navigation
Validate Release Secrets #23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Validate Release Secrets | |
| on: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| # npm needs no secret: every @debugmcp package publishes through trusted | |
| # publishing (OIDC) from release.yml. Docker Hub is the one credential left. | |
| validate-docker: | |
| name: "Docker Hub: credentials" | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Test login | |
| env: | |
| DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }} | |
| DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }} | |
| run: | | |
| if echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin 2>&1; then | |
| echo "✅ Docker Hub credentials are valid" | |
| docker logout > /dev/null 2>&1 | |
| else | |
| echo "❌ Docker Hub credentials are invalid" | |
| echo " Fix: update DOCKER_USERNAME/DOCKER_PASSWORD secrets" | |
| exit 1 | |
| fi | |
| # PyPI publishing uses trusted publishing (OIDC) — there is no PyPI token | |
| # to validate. The trusted publisher is configured on pypi.org for | |
| # debug-mcp-server-launcher (repo debugmcp/mcp-debugger, workflow | |
| # release.yml). |