From 39dbeb35fcaeb3d641f49e77fdec9f4c8fff8bca Mon Sep 17 00:00:00 2001
From: Singtaa <126031603+Singtaa@users.noreply.github.com>
Date: Fri, 9 Oct 2026 16:10:35 -0700
Subject: [PATCH] Pull ubuntu:22.04 from Docker's ECR mirror, and log in to
 Docker Hub when a token exists, so its anonymous pull limit stops failing CI

---
 .github/workflows/ci.yml | 19 ++++++++++++++++++-
 Plugins/README.md        |  2 +-
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ca325657..56112857 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -101,6 +101,8 @@ jobs:
     # after merge.
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     environment: unity-ci
+    env:
+      HAS_DOCKERHUB: ${{ secrets.DOCKERHUB_USERNAME != '' && secrets.DOCKERHUB_TOKEN != '' }}
 
     steps:
       - uses: actions/checkout@v4
@@ -108,6 +110,19 @@ jobs:
           # The QuickJS engine sources are submodules under Auxiliary~.
           submodules: recursive
 
+      # Docker Hub's anonymous pull limit is per runner IP, and busy days hit it
+      # (Singtaa/OneJSv3Container#14). The editor image the test runner pulls,
+      # unityci/editor, has no public mirror, so a login is what lifts the
+      # limit for it. Runs once DOCKERHUB_USERNAME and DOCKERHUB_TOKEN (a
+      # read-only access token) exist; until then it is skipped and the pull
+      # stays anonymous. No value is echoed.
+      - name: Log in to Docker Hub
+        if: env.HAS_DOCKERHUB == 'true'
+        env:
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+        run: echo "$DOCKERHUB_TOKEN" | docker login --username "$DOCKERHUB_USERNAME" --password-stdin
+
       # The repo ships a prebuilt Linux .so (produced in this same ubuntu:22.04
       # container: see Plugins/README.md). CI still rebuilds it from the
       # vendored QuickJS source each run, overwriting the committed binary for
@@ -118,7 +133,9 @@ jobs:
           # than the unityci test container's (the runner's 24.04 glibc is not
           # available in there). This is also the pinned baseline for the
           # committed binary (glibc 2.35, Unity 6's own Ubuntu 22.04 floor).
-          docker run --rm -v "$PWD":/repo -w /repo ubuntu:22.04 bash -c \
+          # From Docker's official mirror on ECR, which has no anonymous pull
+          # limit, rather than Docker Hub, which does.
+          docker run --rm -v "$PWD":/repo -w /repo public.ecr.aws/docker/library/ubuntu:22.04 bash -c \
             "apt-get update -qq && apt-get install -y -qq gcc make > /dev/null && bash Auxiliary~/quickjs-unity/build-linux.sh"
 
       # OneJS is a package, so CI hosts it inside a throwaway project. The host's
diff --git a/Plugins/README.md b/Plugins/README.md
index 67347f70..a5bea865 100644
--- a/Plugins/README.md
+++ b/Plugins/README.md
@@ -132,7 +132,7 @@ with the same command CI uses (add `--platform linux/amd64` on Apple Silicon):
 
 ```bash
 cd <package root>
-docker run --rm -v "$PWD":/repo -w /repo ubuntu:22.04 bash -c \
+docker run --rm -v "$PWD":/repo -w /repo public.ecr.aws/docker/library/ubuntu:22.04 bash -c \
   "apt-get update -qq && apt-get install -y -qq gcc make > /dev/null && bash Auxiliary~/quickjs-unity/build-linux.sh"
 ```