From 4082db9f4355afc049545de9ed339cd414c35a89 Mon Sep 17 00:00:00 2001
From: Shane Engelman <shane.engelman@blacklanternsecurity.com>
Date: Tue, 6 Oct 2026 08:26:17 -0700
Subject: [PATCH] fix(publish): optional registry login for image SBOMs

anchore/sbom-action cannot pull private images without credentials, so
every tag release with private images failed in image-sbom. Add a
registry-token secret plus registry and registry-username inputs, and
log in only when the token is provided so public callers are unchanged.
---
 .github/workflows/publish.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ca14af0..6181479 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -26,6 +26,18 @@ on:
         description: Glob of files attached to the release, relative to the repository root
         type: string
         default: ""
+      registry:
+        description: Registry to log in to before generating image SBOMs, used only when registry-token is passed
+        type: string
+        default: docker.io
+      registry-username:
+        description: Username for the registry login
+        type: string
+        default: ""
+    secrets:
+      registry-token:
+        description: Token for pulling private images; omit for public images
+        required: false
 
 permissions:
   contents: read
@@ -95,6 +107,16 @@ jobs:
         env:
           IMAGE: ${{ matrix.image }}
         run: echo "file=$(tr '/:@' '___' <<<"$IMAGE")-${GITHUB_REF_NAME}.spdx.json" >> "$GITHUB_OUTPUT"
+      - id: auth
+        env:
+          TOKEN: ${{ secrets.registry-token }}
+        run: echo "login=$([ -n "$TOKEN" ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+      - if: steps.auth.outputs.login == 'true'
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          registry: ${{ inputs.registry }}
+          username: ${{ inputs.registry-username }}
+          password: ${{ secrets.registry-token }}
       - uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           image: ${{ matrix.image }}