如何在GitHub Actions的docker/build-push-action v3中指定自定义镜像仓库？

问题重现 #

使用以下GitHub Actions脚本推送镜像时出现401授权错误：

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v2

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v2

    - name: Login to Docker Hub
      uses: docker/login-action@v2
      with:
        registry: ${{ secrets.ALI_DOCKER_HUB_REGISTRY }}
        username: ${{ secrets.ALIYUN_DOCKER_REPO_USER_NAME }}
        password: ${{ secrets.ALIYUN_DOCKER_REPO_USER_PASSWORD }}

    - name: Build and push
      uses: docker/build-push-action@v3
      with:
        push: true
        tags: pro/cv:latest

错误信息：

buildx failed with: ERROR: failed to solve: failed to push pro/cv:latest: failed to authorize: failed to fetch oauth token: unexpected status: 401 Unauthorized

解决方案 #

docker/build-push-action@v3确实移除了registry参数，但可以通过在镜像标签中包含完整的自定义仓库地址来指定推送目标，具体修改如下：

修改后的脚本 #

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v2

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v2

    - name: Login to custom registry
      uses: docker/login-action@v2
      with:
        registry: ${{ secrets.ALI_DOCKER_HUB_REGISTRY }}
        username: ${{ secrets.ALIYUN_DOCKER_REPO_USER_NAME }}
        password: ${{ secrets.ALIYUN_DOCKER_REPO_USER_PASSWORD }}

    - name: Build and push
      uses: docker/build-push-action@v3
      with:
        push: true
        # 在标签前添加自定义仓库地址前缀
        tags: ${{ secrets.ALI_DOCKER_HUB_REGISTRY }}/pro/cv:latest

原理说明 #

Docker镜像的完整标签格式为[registry地址]/[命名空间]/[镜像名]:[标签]，当你在tags参数中指定包含自定义仓库地址的完整标签时，buildx会自动识别并将镜像推送到该仓库，无需单独指定registry参数。同时要确保login步骤中的registry参数与标签中的仓库地址完全一致，才能完成正确的授权验证。

内容的提问来源于stack exchange，提问作者spark