safe-global / safe-client-gateway / 36563132177

89%

push

github

chore(ci): stop mirroring images to the public Docker Hub repository (#3524)

The inventory that `staging.yml` was waiting on is done, and the licence boundary settles it.

Everything built from v1.102.0 onward is FSL-1.1-MIT, not MIT: `LICENSE` puts the boundary at commit date 2026-02-16, with `sef-mit-final` tagging the last MIT state and v1.101.0 the last MIT release. The external consumers of `safeglobal/safe-client-gateway-nest` are pinned to MIT-era tags — `kaiachain/kaia-safe-infrastructure` at `v1.29.0`, `ava-labs/avalanche-deploy` at `v1.96.0` plus a digest — so new releases were never going to serve them, and under FSL they are not the same grant anyway.

Nothing breaks by stopping. Those tags are already published and immutable; a push is what adds tags, not what keeps them. The Docker Hub repository and every existing tag stay exactly as they are — `v1.29.0` from 2024-03-05 and `v1.96.0` from 2025-12-01 both still resolve. Deleting tags is the only action that would break a pinned deployment, and this does not do that.

Staging stopped mattering earlier still: `main-<sha>` has had no reader outside Safe since both clusters moved to GHCR on 25 and 29 September, so roughly five pushes a day were landing in a public registry for nobody.

`_build-image.yml` keeps the `docker_image` input and its conditional login, so the mirror is one line away if the decision changes inside the deprecation window. No caller sets it now, and `DOCKER_USER` / `DOCKER_PASSWORD` are gone from both callers.

No behaviour change for either environment: `imageRepository` is set explicitly to the GHCR path in both `values-staging.yaml` and `values-production.yaml`, and `_deploy.yml` bumps the tag GHCR serves.

Two things this does NOT settle, both raised on WA-3428. `latest` on Docker Hub currently points at v1.125.0, which is FSL-era, and freezes there — whether it should stay, be repointed at v1.101.0 or be removed is a licensing question, not an infrastructure one.... (continued)

4494 of 5283 branches covered (85.07%)

Branch coverage included in aggregate %.

11482 of 12598 relevant lines covered (91.14%)

545.8 hits per line