From 23efe24d1402204e3b021e8bc38cb8b631f15516 Mon Sep 17 00:00:00 2001
From: SandObserver <260779319+SandObserver@users.noreply.github.com>
Date: Wed, 12 Aug 2026 22:51:26 -0400
Subject: [PATCH] Chore: stop a Docker Hub description failure failing the
 release

The description update sat between the SBOM generation and its upload, so a
rejection from Docker Hub skipped the upload and marked a release whose image
was already built, pushed and signed as failed.

Move the SBOM upload ahead of both description steps and let the update
continue on error.
---
 .github/workflows/release.yml | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c60b98da..9174fa15 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -196,28 +196,33 @@ jobs:
           upload-artifact: false
           upload-release-assets: false
 
+      # Before the Docker Hub steps. They describe an image that is already
+      # published, so a failure there must not cost the release its SBOM.
+      - name: Upload SBOM
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: sbom-${{ steps.meta.outputs.version }}
+          path: stackyard-${{ steps.meta.outputs.version }}.spdx.json
+          if-no-files-found: error
+
       # The page is only correct for an image that exists, so this runs after
-      # the push, and only for a stable tag: a release candidate must not
-      # rewrite the page describing what `latest` gives you.
+      # the push, and only for a stable tag: a pre-release must not rewrite the
+      # page describing what `latest` gives you.
       - name: Generate the Docker Hub description
         if: steps.registries.outputs.dockerhub == 'true' && steps.tag.outputs.prerelease == 'false'
         run: node scripts/dockerhub-description.js > dockerhub-description.md
 
+      # The description is not part of the release. A rejection here leaves the
+      # Docker Hub page describing an older version and nothing else.
       - name: Update the Docker Hub description
         if: steps.registries.outputs.dockerhub == 'true' && steps.tag.outputs.prerelease == 'false'
+        continue-on-error: true
         uses: peter-evans/dockerhub-description@432a30c9e07499fd01da9f8a49f0faf9e0ca5b77 # v4.0.2
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
-          # The description API needs a token with write access; the pull-only
-          # token the push step is happy with returns 401 here.
+          # The description API needs a token permitted to edit repository
+          # metadata. A token that pushes images is not enough: it returns 403.
           password: ${{ secrets.DOCKERHUB_TOKEN }}
           repository: ${{ vars.DOCKERHUB_NAMESPACE || vars.DOCKERHUB_USERNAME }}/stackyard
           readme-filepath: dockerhub-description.md
           short-description: A self-hosted homelab dashboard you actually want to look at.
-
-      - name: Upload SBOM
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: sbom-${{ steps.meta.outputs.version }}
-          path: stackyard-${{ steps.meta.outputs.version }}.spdx.json
-          if-no-files-found: error