Document authenticating to private build registries#933
Open
danbarr wants to merge 4 commits into
Open
Conversation
The custom package registries section covered setting plaintext build environment variables but not how to supply credentials. Add an 'Authenticate to private registries' subsection covering the --from-secret and --from-env flags on thv config set-build-env, which keep credentials out of the configuration file. Closes #359. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the ToolHive CLI “Build containers” guide to document how to authenticate to private/custom package registries without storing credentials in plaintext in the ToolHive config file, aligning the guide with the --from-secret and --from-env support added to thv config set-build-env.
Changes:
- Add an “Authenticate to private registries” subsection under “Custom package registries”.
- Document
thv config set-build-env --from-secretand--from-envworkflows with examples. - Add a tip explaining how
thv config get-build-envdisplays secret/shell-backed values as references.
Add an 'Authenticate with a credential file' subsection covering thv config set-build-auth-file (npmrc/netrc/yarnrc), the --stdin input mode, the secrets-manager storage model, and the get/unset commands. Complements the set-build-env credential path and addresses the build-auth-file gap from #654. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a 'Customize the runtime image' subsection covering --runtime-image and --runtime-add-package for protocol-scheme builds. Addresses the build customization gap from #654. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This reverts commit c06d4ab.
danbarr
added a commit
that referenced
this pull request
Jun 12, 2026
Add --runtime-image and --runtime-add-package under protocol schemes in the run guide. These are thv run flags that customize the on-demand protocol-scheme build; they're not available on thv build. Corrects the misplaced build-guide section reverted from #933. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Authentication support for custom package registries shipped in stacklok/toolhive#2860 (the
--from-secretand--from-envflags onthv config set-build-env), but the build guide only documented setting plaintext build environment variables. This adds an "Authenticate to private registries" subsection to the custom package registries section, covering how to supply credentials from a ToolHive secret or the shell environment so they stay out of the config file, with a note on build-time resolution into the builder stage only.It also documents the related
thv config set-build-auth-filecommand family (npmrc/netrc/yarnrccredential files, with--stdininput andget/unsetcompanions), which is the file-based counterpart to the environment-variable path and was likewise undocumented.Type of change
Related issues/PRs
Closes #359. Also addresses the
set-build-auth-filebuild-auth gap tracked in #654 (high-priority gap #8). Feature reference: stacklok/toolhive#2860.