fix(ci): prioritize Docker Hub authentication before setup actions and enable canary workflow chaining

[hapheus]

Summary & Context

In accordance with the post-mortem meeting decision regarding Docker Hub publishing:

1. Unauthenticated Rate Limit Resolution: In .github/workflows/publish-dockerhub.yml, Docker Hub authentication (docker/login-action@v3) has been moved immediately after actions/checkout@v4, strictly BEFORE docker/setup-qemu-action@v3 and docker/setup-buildx-action@v3. This guarantees that image pulls initiated by setup actions (such as tonistiigi/binfmt) utilize authenticated Docker Hub credentials, preventing anonymous pull rate limits (HTTP 429) on GitHub runner IPs.
2. Automated Workflow Chaining: In .github/workflows/daily-image-verification.yml, added a workflow_run trigger listening to the completion of Publish Docker image on main. A job condition ensures the live canary suite runs automatically right after a successful publish.
3. Resilient Canary Image Pulls: Added authenticated Docker Hub login in daily-image-verification.yml prior to docker pull to ensure canary tests are immune to anonymous Docker Hub rate limits.
4. English Only Standard: Normalized all workflow comments and documentation strictly to English.

Quality Gate & Architecture Compliance

• ADR-001 / ADR-002: Clean feature branch fix/docker-publish-auth-and-workflow-chaining from main.
• ADR-004 / ADR-005: Local pre-commit verification passed (27/27 unit tests pass, Ruff static checks clean).
• ADR-006: Awaiting review from Code Reviewer and QA Engineer sign-off.
• Language Policy: 100% English across code, commits, workflows, and PR descriptions.

[hapheus]

QA Blackbox & Pipeline Evaluation Report (ADR-005)

Target: hapheus/torproxy#6
Branch: fix/docker-publish-auth-and-workflow-chaining
Head SHA: 4d8f5e4a7fe952dc3c938a768f2448f1e6effa82
Reviewer: Lead QA Engineer & Blackbox Test Specialist

---

1. CI/CD Pipeline Verification (pr-gate.yml)

• Lint & Static Analysis: ✅ PASSED (Ruff, bash -n, ShellCheck clean)
• Hermetic Unit Tests: ✅ PASSED (27/27 unit tests passed in < 1s)
• Docker Build & Smoke Test: ✅ PASSED (Non-root user verification, process tree multi-daemon checks, graceful shutdown < 5s)
• Check Run Status: All 3 status checks completed with conclusion success on commit 4d8f5e4a7fe952dc3c938a768f2448f1e6effa82.

---

2. Blackbox & Edge-Case Architecture Analysis

• Post-Mortem Implementation Verification:
  • publish-dockerhub.yml: docker/login-action@v3 is correctly positioned immediately after actions/checkout@v4 and before docker/setup-qemu-action@v3 and docker/setup-buildx-action@v3. This guarantees that binfmt/QEMU emulation image pulls (tonistiigi/binfmt) are authenticated against Docker Hub, completely preventing anonymous IP rate-limiting (HTTP 429) on GitHub Actions runners.
• Workflow Chaining & Event Filtering:
  • daily-image-verification.yml: Configured with workflow_run trigger listening to "Publish Docker image" on branch main.
  • Workflow name matches the name declared in publish-dockerhub.yml (name: Publish Docker image) exactly.
  • Job guard condition if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }} accurately permits scheduled runs and manual dispatches while strictly preventing execution if the upstream publish run failed or was cancelled.
• Canary Pull Resiliency & Graceful Degradation:
  • Added Docker Hub authentication step prior to pulling hapheus/torproxy:${IMAGE_TAG} in the verification job.
  • Guarded with if: env.DOCKERHUB_TOKEN != '', allowing graceful fallback if credentials are absent on untrusted fork contexts.
• Language Policy Compliance:
  • All comments and workflow documentation are 100% in English.

---

3. QA Verdict & Release Gate Status

• Quality Gate (ADR-005): ✅ QA SIGN-OFF APPROVED
• Handover to ADR-006: The PR is verified, stable, and ready for Code Reviewer gatekeeper review and merge.

[hapheus]

Pre-Commit / Pre-Merge Code Review (ADR-006)

1. Architectural & Standards Compliance (ADR-001 - ADR-010)

• ADR-001 / ADR-002 / ADR-003: Focused, atomic changes for workflow orchestration and rate-limit resilience. Clean branch name and git hygiene.
• ADR-010 (Minimal Dependencies): Reuses standard GitHub Actions (docker/login-action@v3) with zero extraneous tooling.

2. Rate Limit Prevention & Security

• Authentication Placement: In .github/workflows/publish-dockerhub.yml, docker/login-action@v3 has been moved immediately after actions/checkout@v4, strictly BEFORE docker/setup-qemu-action@v3 and docker/setup-buildx-action@v3. This guarantees that helper image pulls (such as tonistiigi/binfmt) utilize authenticated credentials, preventing unauthenticated HTTP 429 pull rate limits on shared GitHub Actions runner IPs.
• Canary Login: Added defensive Docker Hub authentication in .github/workflows/daily-image-verification.yml prior to pulling live images.

3. Workflow Chaining & Post-Merge Automation

• Workflow Chaining: Added workflow_run trigger in daily-image-verification.yml targeting Publish Docker image on main.
• Conditioning: Robust guard ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }} prevents running the live canary on failed publishes.

4. CI Pipeline Verification

• GitHub Actions Run: Run #38030788977 — 100% PASSED
  • Lint & Static Analysis: Success (Ruff, bash -n, ShellCheck)
  • Hermetic Unit Tests: Success (27/27 tests passed)
  • Docker Build & Container Smoke Test: Success (Non-root UID != 0, multi-daemon inspection, graceful SIGTERM shutdown)

5. Language Standard

• 100% English maintained across all workflow definitions and comments.

6. Gatekeeper Verdict

• Code Review: APPROVED (Code & Architecture Gate Passed)
• Merge Status: PENDING QA SIGN-OFF (ADR-005 Gate). The PR will be merged once the QA Engineer confirms their verification.