Push from CI

Goal: every commit builds an image and pushes it to Dodil Registry, authenticated with a long-lived (or TTL’d) API key — no interactive login anywhere.

1. Issue a CI key

Once, from your workstation:


dodil auth apikey issue --name ci-pusher --role registry.developer --service registry --ttl 2160h

Save the dk_... secret into your CI provider’s secret store (below: DODIL_REGISTRY_KEY). The key is bound to its own managed service account — revoke or rotate it later with dodil auth apikey revoke / rotate without touching any user account. Scope it to specific repositories with --drn if you want least privilege.

2. Log in and push

docker login takes the key as the password; the username is arbitrary:


echo "$DODIL_REGISTRY_KEY" | docker login registry.dodil.io -u ci --password-stdin
docker build -t registry.dodil.io/acme/web:$GIT_SHA .
docker push registry.dodil.io/acme/web:$GIT_SHA

The first push creates the web repository (private) if it doesn’t exist.

GitHub Actions example


name: push-image
on:
  push:
    branches: [main]
 
jobs:
  build-push:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Log in to Dodil Registry
        run: echo "${{ secrets.DODIL_REGISTRY_KEY }}" | docker login registry.dodil.io -u ci --password-stdin
 
      - name: Build & push
        run: |
          docker build -t registry.dodil.io/acme/web:${{ github.sha }} .
          docker push registry.dodil.io/acme/web:${{ github.sha }}

3. Optional: gate on the CVE scan

The push triggers a scan automatically. Poll the vulnerability report with the same key (Basic auth) and fail on Critical findings:


REPORT_URL="https://registry.dodil.io/acme/web/artifacts/${GIT_SHA}/vulnerabilities"
 
# wait for the scan, then gate
for i in $(seq 1 10); do
  SEV=$(curl -sf -u "ci:$DODIL_REGISTRY_KEY" "$REPORT_URL" | jq -r '.severity // empty') && [ -n "$SEV" ] && break
  sleep 10
done
 
echo "worst severity: $SEV"
[ "$(echo "$SEV" | tr '[:upper:]' '[:lower:]')" != "critical" ] || { echo "Critical CVEs — failing"; exit 1; }

(If the dodil CLI is installed in CI, dodil registry vuln web "$GIT_SHA" -o json --token "$DODIL_REGISTRY_KEY" does the same — see Vulnerability Scanning.)

4. Release tagging

When a build is blessed, retag without rebuilding:


docker pull registry.dodil.io/acme/web:$GIT_SHA
docker tag registry.dodil.io/acme/web:$GIT_SHA registry.dodil.io/acme/web:1.2.0
docker push registry.dodil.io/acme/web:1.2.0

Both tags now point at the same digest — verify with dodil registry tag list web 1.2.0.