From aee282613f3e40c9ff015ed7ec0234734a304a39 Mon Sep 17 00:00:00 2001
From: Ahmad Kaouk <56095276+ahmadkaouk@users.noreply.github.com>
Date: Wed, 7 Jan 2026 13:06:33 +0100
Subject: [PATCH] ci: add Docker Hub authentication to E2E workflow (#380)

## Summary
- Fix Docker Hub rate limit errors in E2E CI job by adding
authentication
- Pass existing `DOCKERHUB_USERNAME` and `DOCKERHUB_TOKEN` secrets to
the E2E workflow

  ## Problem
The E2E CI job pulls `datahavenxyz/snowbridge-relay:latest` from Docker
Hub without authentication, causing rate limit errors (10 pulls/hour for
unauthenticated requests):
```
Error: initializing source docker://datahavenxyz/snowbridge-relay:latest: reading manifest latest in docker.io/datahavenxyz/snowbridge-relay: toomanyrequests: You have reached your unauthenticated pull rate limit.
```
  ## Solution
Reuse the Docker Hub secrets already configured for
`docker-build-release` by:
  1. Passing secrets from `CI.yml` to the E2E workflow
  2. Adding optional secrets declaration in `task-e2e.yml`
  3. Adding Docker Hub login step before pulling `snowbridge-relay`

---------

Co-authored-by: Steve Degosserie <723552+stiiifff@users.noreply.github.com>
---
 .github/workflows/CI.yml       |  3 +++
 .github/workflows/task-e2e.yml | 13 +++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index dbb1eb44..44af1e6f 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -73,3 +73,6 @@ jobs:
     # Note: GITHUB_TOKEN is automatically available to reusable workflows
     with:
       image-tag: ${{ needs.docker-build-ci.outputs.image-tag }}
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/task-e2e.yml b/.github/workflows/task-e2e.yml
index c4e79add..b135f97b 100644
--- a/.github/workflows/task-e2e.yml
+++ b/.github/workflows/task-e2e.yml
@@ -21,6 +21,11 @@ on:
         description: "The tag of the docker image"
         required: true
         type: string
+    secrets:
+      DOCKERHUB_USERNAME:
+        required: false
+      DOCKERHUB_TOKEN:
+        required: false
 
 permissions:
   contents: read
@@ -138,6 +143,14 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Login to Docker Hub
+        if: github.repository == 'datahaven-xyz/datahaven'
+        uses: docker/login-action@v3
+        with:
+          registry: docker.io
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
       - name: Download Snowbridge relay binary
         run: |
           docker create --name temp datahavenxyz/snowbridge-relay:latest