From eb6509f908c150cd5d0f9620434d3c7fce2ab467 Mon Sep 17 00:00:00 2001
From: camilesing <camilesing@gmail.com>
Date: Fri, 11 Sep 2026 17:07:28 +0800
Subject: [PATCH] fix(ci): move hub secret check into job env (secrets not
 allowed in step if)

---
 .github/workflows/docker-publish.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index bd3337c..b145f3e 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -26,6 +26,9 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    env:
+      # 仅为让步骤 if 判断可用（secrets 上下文不允许直接出现在步骤 if 表达式中）
+      HUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -66,7 +69,7 @@ jobs:
       - name: 计算版本与镜像 tag 列表（按已配置的镜像站生成）
         id: tags
         env:
-          HUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          # HUB_USERNAME 已由 job 级 env 注入；ALI_REGISTRY 直接读 vars
           ALI_REGISTRY: ${{ vars.ALI_REGISTRY }}
         run: |
           if [ "$GITHUB_REF_TYPE" = "tag" ]; then
@@ -102,7 +105,7 @@ jobs:
           echo "version=$V" >> "$GITHUB_OUTPUT"
 
       - name: Login Docker Hub（可选项，配置了才执行）
-        if: secrets.DOCKERHUB_USERNAME != ''
+        if: env.HUB_USERNAME != ''
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}