fix: correct step order — docker login must precede supplemental push

The previous fix moved build_push_supplemental before docker_push_ghcr, but docker_push_ghcr contains the docker login to GHCR. Without it, supplemental pushes fail with 'unauthorized'. Correct order: docker_push_ghcr (login + push main) first, then build_push_supplemental (build + push supplementals), then health_check (supplementals now in local Docker cache). Main image is pushed before health check, but Trivy has already scanned it and a health check failure still prevents the CD update step.
2026-03-27 10:32:34 -05:00
1 changed files with 1 additions and 1 deletions
@@ -61,6 +61,7 @@ steps:
  - run_trivy_image:
      image_tag: << parameters.registry >>/<< parameters.image_name >>:${DOCKER_TAG}
  - save_trivy_cache
+  - docker_push_ghcr
  - build_push_supplemental:
      supplemental_images: << parameters.supplemental_images >>
      image_name: << parameters.image_name >>
@@ -71,4 +72,3 @@ steps:
      health_db: << parameters.health_db >>
      health_migrations: << parameters.health_migrations >>
      health_smoke_paths: << parameters.health_smoke_paths >>
-  - docker_push_ghcr