From e98d5c749bbb594367a3be7f34d583dd64f48956 Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Tue, 26 May 2026 22:33:32 -0400
Subject: [PATCH 1/7] Better scope secret access.

---
 .github/workflows/docker-hub.yml                |  9 ++++++---
 .github/workflows/github-container-registry.yml |  9 ++++++---
 templates/workflow.yml-template                 | 15 ++++++++++-----
 3 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/docker-hub.yml b/.github/workflows/docker-hub.yml
index 05b4dd0..3b3a891 100644
--- a/.github/workflows/docker-hub.yml
+++ b/.github/workflows/docker-hub.yml
@@ -22,8 +22,6 @@ on:
     - cron: '0 0 * * 0'
 
 env:
-  REGISTRY_USERNAME: garypendergast
-  REGISTRY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
   PACKAGE_REGISTRY_HOST:
   PACKAGE_REGISTRY: wordpressdevelop
   PR_TAG:
@@ -53,6 +51,9 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '8.3'
+      REGISTRY_USERNAME: garypendergast
+      REGISTRY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      
     permissions:
       contents: read
 
@@ -101,7 +102,9 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '8.3'
-
+      REGISTRY_USERNAME: garypendergast
+      REGISTRY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/.github/workflows/github-container-registry.yml b/.github/workflows/github-container-registry.yml
index d8c6899..af0d9a4 100644
--- a/.github/workflows/github-container-registry.yml
+++ b/.github/workflows/github-container-registry.yml
@@ -13,8 +13,6 @@ on:
   workflow_dispatch:
 
 env:
-  REGISTRY_USERNAME: desrosj
-  REGISTRY_PASSWORD: ${{ secrets.GHCR_TOKEN }}
   PACKAGE_REGISTRY_HOST: ghcr.io
   PACKAGE_REGISTRY: ghcr.io/wordpress/wpdev-docker-images
   PR_TAG: -${{ github.event.number }}
@@ -66,6 +64,9 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '8.3'
+      REGISTRY_USERNAME: desrosj
+      REGISTRY_PASSWORD: ${{ secrets.GHCR_TOKEN }}
+      
     permissions:
       contents: read
 
@@ -114,7 +115,9 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '8.3'
-
+      REGISTRY_USERNAME: desrosj
+      REGISTRY_PASSWORD: ${{ secrets.GHCR_TOKEN }}
+      
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/templates/workflow.yml-template b/templates/workflow.yml-template
index 91b1870..77e8a91 100644
--- a/templates/workflow.yml-template
+++ b/templates/workflow.yml-template
@@ -17,8 +17,6 @@ on:
     - cron: '0 0 * * 0'
 
 env:
-  REGISTRY_USERNAME: garypendergast
-  REGISTRY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
   PACKAGE_REGISTRY_HOST:
   PACKAGE_REGISTRY: wordpressdevelop
   PR_TAG:
@@ -31,8 +29,6 @@ on:
   workflow_dispatch:
 
 env:
-  REGISTRY_USERNAME: desrosj
-  REGISTRY_PASSWORD: ${{ secrets.GHCR_TOKEN }}
   PACKAGE_REGISTRY_HOST: ghcr.io
   PACKAGE_REGISTRY: ghcr.io/wordpress/wpdev-docker-images
   PR_TAG: -${{ github.event.number }}
@@ -84,6 +80,11 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '%%PHP_LATEST%%'
+      %%GITHUB%%REGISTRY_USERNAME: desrosj
+      REGISTRY_PASSWORD: ${{ secrets.GHCR_TOKEN }}
+      %%/GITHUB%%%%DOCKER_HUB%%REGISTRY_USERNAME: garypendergast
+      REGISTRY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      %%/DOCKER_HUB%%
     permissions:
       contents: read
 
@@ -132,7 +133,11 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '%%PHP_LATEST%%'
-
+      %%GITHUB%%REGISTRY_USERNAME: desrosj
+      REGISTRY_PASSWORD: ${{ secrets.GHCR_TOKEN }}
+      %%/GITHUB%%%%DOCKER_HUB%%REGISTRY_USERNAME: garypendergast
+      REGISTRY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      %%/DOCKER_HUB%%
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

From 75e03e5f51a05e3c457f970fa4dd147b7d286499 Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Tue, 26 May 2026 22:40:38 -0400
Subject: [PATCH 2/7] Make use of the official `docker-login` action.

Currently a warning is displayed in the GitHub Actions logs:

```
WARNING! Your credentials are stored unencrypted in '/home/runner/.docker/config.json'.
Configure a credential helper to remove this warning. See
https://docs.docker.com/go/credential-store/
```

While the `docker-login` action does not implement a credential store, it does log out immediately after the job completes (which removes any auth-related entries from the `config.json` file), and silences the warning by using `silent: true`.

This also configures two environments: `staging` and `production`. This provides some additional protection for secret values by limiting when certain secrets are available at all.
---
 .github/workflows/docker-hub.yml              | 24 ++++++++-------
 .../workflows/github-container-registry.yml   | 26 +++++++++-------
 templates/workflow.yml-template               | 30 ++++++++++---------
 3 files changed, 46 insertions(+), 34 deletions(-)

diff --git a/.github/workflows/docker-hub.yml b/.github/workflows/docker-hub.yml
index 3b3a891..61e21f9 100644
--- a/.github/workflows/docker-hub.yml
+++ b/.github/workflows/docker-hub.yml
@@ -44,6 +44,7 @@ jobs:
     name: PHP ${{ matrix.php }} Image
     runs-on: ubuntu-latest
     
+    environment: 'production'
     strategy:
       matrix:
         php: [ '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5' ]
@@ -51,9 +52,8 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '8.3'
-      REGISTRY_USERNAME: garypendergast
-      REGISTRY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-      
+      REGISTRY_USERNAME: ${{ var.REGISTRY_USERNAME }}
+      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     permissions:
       contents: read
 
@@ -64,8 +64,10 @@ jobs:
           persist-credentials: false
 
       - name: Login to the package registry
-        run: |
-          echo "$REGISTRY_PASSWORD" | docker login "$PACKAGE_REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          username: ${{ env.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Build Docker image
         run: |
@@ -92,6 +94,7 @@ jobs:
     name: CLI on PHP ${{ matrix.php }}
     runs-on: ubuntu-latest
     needs: build-php-images
+    environment: 'production'
     strategy:
       matrix:
         php: [ '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5' ]
@@ -102,9 +105,8 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '8.3'
-      REGISTRY_USERNAME: garypendergast
-      REGISTRY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-      
+      REGISTRY_USERNAME: ${{ var.REGISTRY_USERNAME }}
+      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -112,8 +114,10 @@ jobs:
           persist-credentials: false
 
       - name: Login to the package registry
-        run: |
-          echo "$REGISTRY_PASSWORD" | docker login "$PACKAGE_REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          username: ${{ env.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Build Docker image
         run: |
diff --git a/.github/workflows/github-container-registry.yml b/.github/workflows/github-container-registry.yml
index af0d9a4..1e74a9a 100644
--- a/.github/workflows/github-container-registry.yml
+++ b/.github/workflows/github-container-registry.yml
@@ -57,6 +57,7 @@ jobs:
     name: PHP ${{ matrix.php }} Image
     runs-on: ubuntu-latest
     needs: [ check-for-changes ]
+    environment: 'staging'
     strategy:
       matrix:
         php: [ '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5' ]
@@ -64,9 +65,8 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '8.3'
-      REGISTRY_USERNAME: desrosj
-      REGISTRY_PASSWORD: ${{ secrets.GHCR_TOKEN }}
-      
+      REGISTRY_USERNAME: ${{ var.REGISTRY_USERNAME }}
+      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     permissions:
       contents: read
 
@@ -77,8 +77,11 @@ jobs:
           persist-credentials: false
 
       - name: Login to the package registry
-        run: |
-          echo "$REGISTRY_PASSWORD" | docker login "$PACKAGE_REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          registry: ghcr.io
+          username: ${{ env.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Build Docker image
         run: |
@@ -105,6 +108,7 @@ jobs:
     name: CLI on PHP ${{ matrix.php }}
     runs-on: ubuntu-latest
     needs: build-php-images
+    environment: 'staging'
     strategy:
       matrix:
         php: [ '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5' ]
@@ -115,9 +119,8 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '8.3'
-      REGISTRY_USERNAME: desrosj
-      REGISTRY_PASSWORD: ${{ secrets.GHCR_TOKEN }}
-      
+      REGISTRY_USERNAME: ${{ var.REGISTRY_USERNAME }}
+      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -125,8 +128,11 @@ jobs:
           persist-credentials: false
 
       - name: Login to the package registry
-        run: |
-          echo "$REGISTRY_PASSWORD" | docker login "$PACKAGE_REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          registry: ghcr.io
+          username: ${{ env.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Build Docker image
         run: |
diff --git a/templates/workflow.yml-template b/templates/workflow.yml-template
index 77e8a91..7d60575 100644
--- a/templates/workflow.yml-template
+++ b/templates/workflow.yml-template
@@ -73,6 +73,7 @@ jobs:
     name: PHP ${{ matrix.php }} Image
     runs-on: ubuntu-latest
     %%GITHUB%%needs: [ check-for-changes ]%%/GITHUB%%
+    environment: '%%GITHUB%%staging%%/GITHUB%%%%DOCKER_HUB%%production%%/DOCKER_HUB%%'
     strategy:
       matrix:
         php: [ %%PHP_VERSION_LIST%% ]
@@ -80,11 +81,8 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '%%PHP_LATEST%%'
-      %%GITHUB%%REGISTRY_USERNAME: desrosj
-      REGISTRY_PASSWORD: ${{ secrets.GHCR_TOKEN }}
-      %%/GITHUB%%%%DOCKER_HUB%%REGISTRY_USERNAME: garypendergast
-      REGISTRY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-      %%/DOCKER_HUB%%
+      REGISTRY_USERNAME: ${{ var.REGISTRY_USERNAME }}
+      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     permissions:
       contents: read
 
@@ -95,8 +93,11 @@ jobs:
           persist-credentials: false
 
       - name: Login to the package registry
-        run: |
-          echo "$REGISTRY_PASSWORD" | docker login "$PACKAGE_REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:%%GITHUB%%
+          registry: ghcr.io%%/GITHUB%%
+          username: ${{ env.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Build Docker image
         run: |
@@ -123,6 +124,7 @@ jobs:
     name: CLI on PHP ${{ matrix.php }}
     runs-on: ubuntu-latest
     needs: build-php-images
+    environment: '%%GITHUB%%staging%%/GITHUB%%%%DOCKER_HUB%%production%%/DOCKER_HUB%%'
     strategy:
       matrix:
         php: [ %%PHP_VERSION_LIST%% ]
@@ -133,11 +135,8 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '%%PHP_LATEST%%'
-      %%GITHUB%%REGISTRY_USERNAME: desrosj
-      REGISTRY_PASSWORD: ${{ secrets.GHCR_TOKEN }}
-      %%/GITHUB%%%%DOCKER_HUB%%REGISTRY_USERNAME: garypendergast
-      REGISTRY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-      %%/DOCKER_HUB%%
+      REGISTRY_USERNAME: ${{ var.REGISTRY_USERNAME }}
+      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -145,8 +144,11 @@ jobs:
           persist-credentials: false
 
       - name: Login to the package registry
-        run: |
-          echo "$REGISTRY_PASSWORD" | docker login "$PACKAGE_REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:%%GITHUB%%
+          registry: ghcr.io%%/GITHUB%%
+          username: ${{ env.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Build Docker image
         run: |

From 57dc0ed3e99a57ba226d650509b7142da564942b Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Tue, 26 May 2026 23:15:56 -0400
Subject: [PATCH 3/7] Remove unused `PACKAGE_REGISTRY_HOST` var.

---
 .github/workflows/docker-hub.yml                | 1 -
 .github/workflows/github-container-registry.yml | 1 -
 templates/workflow.yml-template                 | 2 --
 3 files changed, 4 deletions(-)

diff --git a/.github/workflows/docker-hub.yml b/.github/workflows/docker-hub.yml
index 61e21f9..e911cfb 100644
--- a/.github/workflows/docker-hub.yml
+++ b/.github/workflows/docker-hub.yml
@@ -22,7 +22,6 @@ on:
     - cron: '0 0 * * 0'
 
 env:
-  PACKAGE_REGISTRY_HOST:
   PACKAGE_REGISTRY: wordpressdevelop
   PR_TAG:
 
diff --git a/.github/workflows/github-container-registry.yml b/.github/workflows/github-container-registry.yml
index 1e74a9a..333642d 100644
--- a/.github/workflows/github-container-registry.yml
+++ b/.github/workflows/github-container-registry.yml
@@ -13,7 +13,6 @@ on:
   workflow_dispatch:
 
 env:
-  PACKAGE_REGISTRY_HOST: ghcr.io
   PACKAGE_REGISTRY: ghcr.io/wordpress/wpdev-docker-images
   PR_TAG: -${{ github.event.number }}
 
diff --git a/templates/workflow.yml-template b/templates/workflow.yml-template
index 7d60575..969c0b4 100644
--- a/templates/workflow.yml-template
+++ b/templates/workflow.yml-template
@@ -17,7 +17,6 @@ on:
     - cron: '0 0 * * 0'
 
 env:
-  PACKAGE_REGISTRY_HOST:
   PACKAGE_REGISTRY: wordpressdevelop
   PR_TAG:
 %%/DOCKER_HUB%%
@@ -29,7 +28,6 @@ on:
   workflow_dispatch:
 
 env:
-  PACKAGE_REGISTRY_HOST: ghcr.io
   PACKAGE_REGISTRY: ghcr.io/wordpress/wpdev-docker-images
   PR_TAG: -${{ github.event.number }}
 %%/GITHUB%%

From d7f5081dff8458b219e243b89b60dcbd9c9ec7ef Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Tue, 26 May 2026 23:25:12 -0400
Subject: [PATCH 4/7] Drop `PACKAGE_REGISTRY` from PHP builds.

`PACKAGE_REGISTRY` instructs the `docker build` command where to pull the base image for `FROM`. Since the `php` images do not pull from a WordPress-specific source, this is unnecessary.
---
 .github/workflows/docker-hub.yml                | 1 -
 .github/workflows/github-container-registry.yml | 1 -
 templates/workflow.yml-template                 | 1 -
 3 files changed, 3 deletions(-)

diff --git a/.github/workflows/docker-hub.yml b/.github/workflows/docker-hub.yml
index e911cfb..53af606 100644
--- a/.github/workflows/docker-hub.yml
+++ b/.github/workflows/docker-hub.yml
@@ -71,7 +71,6 @@ jobs:
       - name: Build Docker image
         run: |
           docker build \
-            --build-arg PACKAGE_REGISTRY="$PACKAGE_REGISTRY" \
             --build-arg PR_TAG="$PR_TAG" \
             -t "$PACKAGE_REGISTRY/php:$PHP_VERSION-fpm$PR_TAG" \
             "images/$PHP_VERSION/php"
diff --git a/.github/workflows/github-container-registry.yml b/.github/workflows/github-container-registry.yml
index 333642d..7e8f653 100644
--- a/.github/workflows/github-container-registry.yml
+++ b/.github/workflows/github-container-registry.yml
@@ -85,7 +85,6 @@ jobs:
       - name: Build Docker image
         run: |
           docker build \
-            --build-arg PACKAGE_REGISTRY="$PACKAGE_REGISTRY" \
             --build-arg PR_TAG="$PR_TAG" \
             -t "$PACKAGE_REGISTRY/php:$PHP_VERSION-fpm$PR_TAG" \
             "images/$PHP_VERSION/php"
diff --git a/templates/workflow.yml-template b/templates/workflow.yml-template
index 969c0b4..89a253c 100644
--- a/templates/workflow.yml-template
+++ b/templates/workflow.yml-template
@@ -100,7 +100,6 @@ jobs:
       - name: Build Docker image
         run: |
           docker build \
-            --build-arg PACKAGE_REGISTRY="$PACKAGE_REGISTRY" \
             --build-arg PR_TAG="$PR_TAG" \
             -t "$PACKAGE_REGISTRY/php:$PHP_VERSION-fpm$PR_TAG" \
             "images/$PHP_VERSION/php"

From 1728cedaa65705c0372074a3d006e127ac5727d5 Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Tue, 26 May 2026 23:30:42 -0400
Subject: [PATCH 5/7] Correct typo in `vars`.

---
 .github/workflows/docker-hub.yml                | 4 ++--
 .github/workflows/github-container-registry.yml | 4 ++--
 templates/workflow.yml-template                 | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/docker-hub.yml b/.github/workflows/docker-hub.yml
index 53af606..874ddb1 100644
--- a/.github/workflows/docker-hub.yml
+++ b/.github/workflows/docker-hub.yml
@@ -51,7 +51,7 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '8.3'
-      REGISTRY_USERNAME: ${{ var.REGISTRY_USERNAME }}
+      REGISTRY_USERNAME: ${{ vars.REGISTRY_USERNAME }}
       REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     permissions:
       contents: read
@@ -103,7 +103,7 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '8.3'
-      REGISTRY_USERNAME: ${{ var.REGISTRY_USERNAME }}
+      REGISTRY_USERNAME: ${{ vars.REGISTRY_USERNAME }}
       REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     steps:
       - name: Checkout repository
diff --git a/.github/workflows/github-container-registry.yml b/.github/workflows/github-container-registry.yml
index 7e8f653..896eb97 100644
--- a/.github/workflows/github-container-registry.yml
+++ b/.github/workflows/github-container-registry.yml
@@ -64,7 +64,7 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '8.3'
-      REGISTRY_USERNAME: ${{ var.REGISTRY_USERNAME }}
+      REGISTRY_USERNAME: ${{ vars.REGISTRY_USERNAME }}
       REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     permissions:
       contents: read
@@ -117,7 +117,7 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '8.3'
-      REGISTRY_USERNAME: ${{ var.REGISTRY_USERNAME }}
+      REGISTRY_USERNAME: ${{ vars.REGISTRY_USERNAME }}
       REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     steps:
       - name: Checkout repository
diff --git a/templates/workflow.yml-template b/templates/workflow.yml-template
index 89a253c..a885a1d 100644
--- a/templates/workflow.yml-template
+++ b/templates/workflow.yml-template
@@ -79,7 +79,7 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '%%PHP_LATEST%%'
-      REGISTRY_USERNAME: ${{ var.REGISTRY_USERNAME }}
+      REGISTRY_USERNAME: ${{ vars.REGISTRY_USERNAME }}
       REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     permissions:
       contents: read
@@ -132,7 +132,7 @@ jobs:
     env:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '%%PHP_LATEST%%'
-      REGISTRY_USERNAME: ${{ var.REGISTRY_USERNAME }}
+      REGISTRY_USERNAME: ${{ vars.REGISTRY_USERNAME }}
       REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     steps:
       - name: Checkout repository

From 46e70284f474f1d23e8a00d58284bd7a8a1d1153 Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Tue, 26 May 2026 23:37:52 -0400
Subject: [PATCH 6/7] Use correct environment names.

---
 .github/workflows/docker-hub.yml                | 4 ++--
 .github/workflows/github-container-registry.yml | 4 ++--
 templates/workflow.yml-template                 | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/docker-hub.yml b/.github/workflows/docker-hub.yml
index 874ddb1..1059949 100644
--- a/.github/workflows/docker-hub.yml
+++ b/.github/workflows/docker-hub.yml
@@ -43,7 +43,7 @@ jobs:
     name: PHP ${{ matrix.php }} Image
     runs-on: ubuntu-latest
     
-    environment: 'production'
+    environment: 'Docker Hub'
     strategy:
       matrix:
         php: [ '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5' ]
@@ -92,7 +92,7 @@ jobs:
     name: CLI on PHP ${{ matrix.php }}
     runs-on: ubuntu-latest
     needs: build-php-images
-    environment: 'production'
+    environment: 'Docker Hub'
     strategy:
       matrix:
         php: [ '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5' ]
diff --git a/.github/workflows/github-container-registry.yml b/.github/workflows/github-container-registry.yml
index 896eb97..7094fbd 100644
--- a/.github/workflows/github-container-registry.yml
+++ b/.github/workflows/github-container-registry.yml
@@ -56,7 +56,7 @@ jobs:
     name: PHP ${{ matrix.php }} Image
     runs-on: ubuntu-latest
     needs: [ check-for-changes ]
-    environment: 'staging'
+    environment: 'GitHub Container Registry'
     strategy:
       matrix:
         php: [ '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5' ]
@@ -106,7 +106,7 @@ jobs:
     name: CLI on PHP ${{ matrix.php }}
     runs-on: ubuntu-latest
     needs: build-php-images
-    environment: 'staging'
+    environment: 'GitHub Container Registry'
     strategy:
       matrix:
         php: [ '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5' ]
diff --git a/templates/workflow.yml-template b/templates/workflow.yml-template
index a885a1d..14bde77 100644
--- a/templates/workflow.yml-template
+++ b/templates/workflow.yml-template
@@ -71,7 +71,7 @@ jobs:
     name: PHP ${{ matrix.php }} Image
     runs-on: ubuntu-latest
     %%GITHUB%%needs: [ check-for-changes ]%%/GITHUB%%
-    environment: '%%GITHUB%%staging%%/GITHUB%%%%DOCKER_HUB%%production%%/DOCKER_HUB%%'
+    environment: '%%GITHUB%%GitHub Container Registry%%/GITHUB%%%%DOCKER_HUB%%Docker Hub%%/DOCKER_HUB%%'
     strategy:
       matrix:
         php: [ %%PHP_VERSION_LIST%% ]
@@ -121,7 +121,7 @@ jobs:
     name: CLI on PHP ${{ matrix.php }}
     runs-on: ubuntu-latest
     needs: build-php-images
-    environment: '%%GITHUB%%staging%%/GITHUB%%%%DOCKER_HUB%%production%%/DOCKER_HUB%%'
+    environment: '%%GITHUB%%GitHub Container Registry%%/GITHUB%%%%DOCKER_HUB%%Docker Hub%%/DOCKER_HUB%%'
     strategy:
       matrix:
         php: [ %%PHP_VERSION_LIST%% ]

From 02f52d5793195673adfd2e627d1afdd531e93aae Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Tue, 26 May 2026 23:49:33 -0400
Subject: [PATCH 7/7] Avoid defining `REGISTRY_PASSWORD` twice.

---
 .github/workflows/docker-hub.yml                | 2 --
 .github/workflows/github-container-registry.yml | 2 --
 templates/workflow.yml-template                 | 2 --
 3 files changed, 6 deletions(-)

diff --git a/.github/workflows/docker-hub.yml b/.github/workflows/docker-hub.yml
index 1059949..4cdb78f 100644
--- a/.github/workflows/docker-hub.yml
+++ b/.github/workflows/docker-hub.yml
@@ -52,7 +52,6 @@ jobs:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '8.3'
       REGISTRY_USERNAME: ${{ vars.REGISTRY_USERNAME }}
-      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     permissions:
       contents: read
 
@@ -104,7 +103,6 @@ jobs:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '8.3'
       REGISTRY_USERNAME: ${{ vars.REGISTRY_USERNAME }}
-      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/.github/workflows/github-container-registry.yml b/.github/workflows/github-container-registry.yml
index 7094fbd..05d5c5b 100644
--- a/.github/workflows/github-container-registry.yml
+++ b/.github/workflows/github-container-registry.yml
@@ -65,7 +65,6 @@ jobs:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '8.3'
       REGISTRY_USERNAME: ${{ vars.REGISTRY_USERNAME }}
-      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     permissions:
       contents: read
 
@@ -118,7 +117,6 @@ jobs:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '8.3'
       REGISTRY_USERNAME: ${{ vars.REGISTRY_USERNAME }}
-      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/templates/workflow.yml-template b/templates/workflow.yml-template
index 14bde77..421e6b4 100644
--- a/templates/workflow.yml-template
+++ b/templates/workflow.yml-template
@@ -80,7 +80,6 @@ jobs:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '%%PHP_LATEST%%'
       REGISTRY_USERNAME: ${{ vars.REGISTRY_USERNAME }}
-      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     permissions:
       contents: read
 
@@ -133,7 +132,6 @@ jobs:
       PHP_VERSION: ${{ matrix.php }}
       PHP_LATEST: '%%PHP_LATEST%%'
       REGISTRY_USERNAME: ${{ vars.REGISTRY_USERNAME }}
-      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_USERNAME }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2