From cefbb1209e7075870610bf9f4fe30351d3ab5045 Mon Sep 17 00:00:00 2001
From: Mehran Mazhar <mehran.mazhar@gmail.com>
Date: Fri, 18 Sep 2026 18:18:50 +0400
Subject: [PATCH] chore: stop publishing to Docker Hub

Every Clutch service in every compose file (clutch-deploy) pulls
ghcr.io/clutchprotocol/*. Nothing deployed reads from Docker Hub -- publishing
there has been write-only since it was added, and it costs two secrets
(DOCKERHUB_USERNAME, DOCKERHUB_TOKEN) that have to be re-added by hand every
time a workflow moves between repos. That is exactly what broke the demo
app's build after the clutch-hub-sdk-js merge on 2026-09-18.

Not deleting the Docker Hub repo itself, and not touching the public docs that
link to it -- that is a separate, slower decision.

Same pass, same defect: trigger-stage-deploy carried `continue-on-error: true`.
With the dispatch token missing, the job failed, the run still reported green,
and stage kept serving the previous image with nothing saying so -- the same
failure shape as an nginx include matching no files (see
clutch-deploy/docs/ALERTING.md). The token is now checked before the dispatch,
with a message naming what a failure here means: the image WAS pushed, stage
will NOT deploy it. A closing step also says that an accepted dispatch is not
a completed deploy, so a green tick on this job is not read as "stage is
running the new image".

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/docker-build-push.yml | 49 +++++++++++--------------
 1 file changed, 22 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/docker-build-push.yml b/.github/workflows/docker-build-push.yml
index 57a25f9..f4f73e5 100644
--- a/.github/workflows/docker-build-push.yml
+++ b/.github/workflows/docker-build-push.yml
@@ -24,7 +24,6 @@ on:
 
 env:
   GHCR_IMAGE: ghcr.io/clutchprotocol/clutch-node
-  DH_IMAGE: docker.io/9194010019/clutch-node
 
 permissions:
   contents: read
@@ -129,20 +128,12 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Log in to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          registry: docker.io
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
       - name: Extract Docker metadata
         id: meta
         uses: docker/metadata-action@v5
         with:
           images: |
             ${{ env.GHCR_IMAGE }}
-            ${{ env.DH_IMAGE }}
           tags: |
             # sha-<short>
             type=sha,format=short
@@ -163,34 +154,38 @@ jobs:
       - name: Image digest
         run: docker buildx imagetools inspect ${{ env.GHCR_IMAGE }}:${{ steps.meta.outputs.version }}
 
-  # Optional: same secret as other Clutch repos — PAT with repo access to dispatch on clutch-deploy.
+  # Same secret as other Clutch repos — PAT with repo access to dispatch on clutch-deploy.
+  #
+  # This job used to carry `continue-on-error: true`. With the secret missing it failed, the run
+  # still reported green, and stage quietly kept serving the previous image. A deploy that does
+  # not happen must not report success — see clutch-deploy/docs/ALERTING.md on that failure shape.
   trigger-stage-deploy:
     needs: merge
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
 
     steps:
+      # Checked before the dispatch: an EMPTY token is the likeliest way to get here and fails
+      # more vaguely than a wrong one.
+      - name: Check the dispatch token is present
+        env:
+          TOKEN: ${{ secrets.CLUTCH_DEPLOY_DISPATCH_TOKEN }}
+        run: |
+          if [ -z "$TOKEN" ]; then
+            echo "::error::CLUTCH_DEPLOY_DISPATCH_TOKEN is not set on this repository."
+            echo "::error::The image WAS pushed. Stage will NOT deploy it."
+            echo "::error::Add the secret (a PAT with repo scope), then re-run this workflow or dispatch deploy-stage in clutch-deploy by hand."
+            exit 1
+          fi
+
       - name: Trigger deploy-stage in clutch-deploy
-        continue-on-error: true
         uses: peter-evans/repository-dispatch@v3
         with:
           token: ${{ secrets.CLUTCH_DEPLOY_DISPATCH_TOKEN }}
           repository: clutchprotocol/clutch-deploy
           event-type: deploy-stage
 
-  update-description:
-    needs: merge
-    runs-on: ubuntu-latest
-    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Update Docker Hub description
-        uses: peter-evans/dockerhub-description@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-          repository: 9194010019/clutch-node
-          readme-filepath: ./README.md
+      - name: What this proves, and what it does not
+        run: |
+          echo "Dispatched deploy-stage to clutchprotocol/clutch-deploy."
+          echo "That deploy is a separate run with its own result. This job only proves the request was accepted."