[Feature] Support nightly container image about kuberay HOT 6 CLOSED

For post submit workflow, we need to build and push two images with nightly and commit hash tags. they are still same image.

from kuberay.

https://kevsoft.net/2020/06/10/running-github-action-steps-and-jobs-only-on-push-to-master.html

This is a good article to talk about conditional step in a job workflow for multiple events (pull_request, push)

from kuberay.

Currently, there're few challenges to build automation.

1. seems there's no way to create robot or service account for KubeRay docker hub organization? Only member belong to team can operate it. The challenge is I have admin access of several organizations and I can not use my personal token in CI.

2. https://github.com/docker/login-action This action helps to authenticate with docker registry.

• The problem is if bad guy update GitHub workflow and echo credential, I assume credential might be leaked?
• hacker still can update workflow to publish image with malicious code to official registry?

I am not an expert on GitHub Actions, I assume these kind of issues should not be there? /cc @akanso

from kuberay.

/cc @wilsonwang371

from kuberay.

seems there's no way to create robot or service account for KubeRay docker hub organization? Only member belong to team can operate it. The challenge is I have admin access of several organizations and I can not use my personal token in CI.

We register a separate account with kubeRay write permission only as the robot account.

https://github.com/docker/login-action This action helps to authenticate with docker registry.

The problem is if bad guy update GitHub workflow and echo credential, I assume credential might be leaked?
hacker still can update workflow to publish image with malicious code to official registry?

Maintainers has to carefully review the code before they approve to run the workflow.
for the presubmit change, we build local image and load into kind cluster for testing.
for the merge change, we build image and push to registry so we can avoid malicious code pushing to registry.

#141 resolve this issue and it can be closed

from kuberay.

Thanks @wilsonwang371 for the help!

from kuberay.