From d1e7f17e3d28b6ef10e8eca00ff9156066fb128b Mon Sep 17 00:00:00 2001
From: Ion Alpha <contact@ionalpha.io>
Date: Wed, 8 Jul 2026 06:47:05 +0000
Subject: [PATCH] ci: sync README to the Docker Hub repository overview

Add a `Docker Hub description` workflow that pushes the README and a short
description to the `ionalpha/flynn` Docker Hub repository whenever the README
changes on main, and on manual dispatch. GoReleaser publishes image bytes on a
tag but does not update these text fields, so without this the Docker Hub
overview stays empty and drifts from the README.

It reuses the existing `DOCKERHUB_USERNAME` and `DOCKERHUB_TOKEN` secrets and
enables URL completion so the README's repo-relative links resolve on Docker Hub.
---
 .github/workflows/dockerhub-description.yml | 32 +++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 .github/workflows/dockerhub-description.yml

diff --git a/.github/workflows/dockerhub-description.yml b/.github/workflows/dockerhub-description.yml
new file mode 100644
index 00000000..2ff1c8d5
--- /dev/null
+++ b/.github/workflows/dockerhub-description.yml
@@ -0,0 +1,32 @@
+name: Docker Hub description
+
+# Keep the Docker Hub repository overview and short description in step with the
+# README. GoReleaser pushes image bytes on a tag but never touches these text
+# fields, so this syncs them whenever the README changes on main (and on demand).
+on:
+  push:
+    branches: [main]
+    paths:
+      - README.md
+      - .github/workflows/dockerhub-description.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  sync:
+    name: Sync README to Docker Hub
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          repository: ionalpha/flynn
+          short-description: "A secure, sandboxed, verifiable self-hosted agent operating system in a single Go binary."
+          readme-filepath: ./README.md
+          # Rewrite the README's repo-relative links to absolute github.com URLs so
+          # they resolve on Docker Hub, which has no notion of the repository tree.
+          enable-url-completion: true