ci: address coderabbit review (DockerHub login guard + use $GITHUB_SHA)

Author: nicktrn

.github/actions/get-image-tag/action.yml

@@ -28,12 +28,12 @@ runs:
         elif [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
           if [[ "${GITHUB_REF_NAME}" == infra-*-* ]]; then
             env=$(echo ${GITHUB_REF_NAME} | cut -d- -f2)
-            sha=$(echo ${{ github.sha }} | head -c7)
+            sha=$(echo "${GITHUB_SHA}" | head -c7)
             ts=$(date +%s)
             tag=${env}-${sha}-${ts}
           elif [[ "${GITHUB_REF_NAME}" == re2-*-* ]]; then
             env=$(echo ${GITHUB_REF_NAME} | cut -d- -f2)
-            sha=$(echo ${{ github.sha }} | head -c7)
+            sha=$(echo "${GITHUB_SHA}" | head -c7)
             ts=$(date +%s)
             tag=${env}-${sha}-${ts}
           elif [[ "${GITHUB_REF_NAME}" == v.docker.* ]]; then

.github/workflows/helm-prerelease.yml

@@ -112,10 +112,10 @@ jobs:
             SHORT_SHA=$(echo "${{ github.event.pull_request.head.sha }}" | cut -c1-7)
             PRERELEASE_VERSION="${BASE_VERSION}-pr${PR_NUMBER}.${SHORT_SHA}"
           elif [[ "${{ github.event_name }}" == "push" ]]; then
-            SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+            SHORT_SHA=$(echo "${GITHUB_SHA}" | cut -c1-7)
             PRERELEASE_VERSION="${BASE_VERSION}-main.${SHORT_SHA}"
           else
-            SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+            SHORT_SHA=$(echo "${GITHUB_SHA}" | cut -c1-7)
             REF_SLUG=$(echo "${GITHUB_REF_NAME}" | tr '/' '-' | tr -cd 'a-zA-Z0-9-')
             if [[ -z "$REF_SLUG" ]]; then
               REF_SLUG="manual"

.github/workflows/publish-webapp.yml

@@ -44,7 +44,7 @@ jobs:
       - name: 🔢 Get the commit hash
         id: get_commit
         run: |
-          echo "sha_short=$(echo ${{ github.sha }} | cut -c1-7)" >> "$GITHUB_OUTPUT"
+          echo "sha_short=$(echo "${GITHUB_SHA}" | cut -c1-7)" >> "$GITHUB_OUTPUT"
 
       - name: 📛 Set the tags
         id: set_tags
@@ -71,7 +71,7 @@ jobs:
             if [[ "${STEPS_GET_TAG_OUTPUTS_IS_SEMVER}" == true ]]; then
               echo "BUILD_APP_VERSION=${tag}"
             fi
-            echo "BUILD_GIT_SHA=${{ github.sha }}"
+            echo "BUILD_GIT_SHA=${GITHUB_SHA}"
             echo "BUILD_GIT_REF_NAME=${GITHUB_REF_NAME}"
             echo "BUILD_TIMESTAMP_SECONDS=$(date +%s)"
           } >> "$GITHUB_OUTPUT"

.github/workflows/publish-worker.yml

@@ -31,6 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       DOCKER_BUILDKIT: "1"
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
     steps:
       - name: ⬇️ Checkout git repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -59,6 +60,7 @@ jobs:
 
       # ..to avoid rate limits when pulling images
       - name: 🐳 Login to DockerHub
+        if: ${{ env.DOCKERHUB_USERNAME }}
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}