ci: pre-pull testcontainer images on fork PRs

[nicktrn]

What

The Pre-pull testcontainer images step is gated on env.DOCKERHUB_USERNAME. Fork PRs receive no repository secrets, so that variable is empty and the step is skipped along with the DockerHub login it was grouped with.

Why

With the pre-pull skipped, testcontainers pulls images lazily — inside the first test that resolves the fixture, against that test's testTimeout. On PR #4534 that pushed five webapp shards past their 60s cap across three runs, each failing as Test timed out in 60000ms while 42 of 43 files in the shard passed.

Measured cost of the missing pre-pull, comparing the delta from vitest start to the first container fixture on the same runner class:

Run	Delta
internal x2	+139.9s, +139.4s
fork x2	+149.7s, +149.4s

A 10.0s penalty, bimodal to within 0.3s.

Note the pulls themselves succeed anonymously — there are no rate-limit errors in any of the failing logs. Only the login needs credentials, so the pre-pull can run unconditionally.

Scope

Removes the if: from the pre-pull step in all five workflows that have one. The DockerHub login stays gated, since it genuinely needs secrets.

[changeset-bot]

⚠️ No Changeset found

Latest commit: e0ad2a7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 957bd690-5763-45ef-b2dd-28c4aca7e00c

📥 Commits

Reviewing files that changed from the base of the PR and between cffaa05 and e0ad2a7.

📒 Files selected for processing (5)

• .github/workflows/e2e-webapp-auth-full.yml
• .github/workflows/e2e-webapp.yml
• .github/workflows/unit-tests-internal.yml
• .github/workflows/unit-tests-packages.yml
• .github/workflows/unit-tests-webapp.yml

💤 Files with no reviewable changes (5)

• .github/workflows/e2e-webapp.yml
• .github/workflows/e2e-webapp-auth-full.yml
• .github/workflows/unit-tests-internal.yml
• .github/workflows/unit-tests-packages.yml
• .github/workflows/unit-tests-webapp.yml

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (21)

• GitHub Check: webapp / 🧪 Unit Tests: Webapp (11, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (7, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (9, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (10, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (12, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (1, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (6, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (5, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (8, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (4, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (2, 12)
• GitHub Check: webapp / 🧪 Unit Tests: Webapp (3, 12)
• GitHub Check: e2e-webapp / 🧪 E2E Tests: Webapp
• GitHub Check: internal / 🧪 Unit Tests: Internal
• GitHub Check: runops-guard / runops-guard
• GitHub Check: packages / 🧪 Unit Tests: Packages (3, 3)
• GitHub Check: packages / 🧪 Unit Tests: Packages (2, 3)
• GitHub Check: fk-cascade-guard / fk-cascade-guard
• GitHub Check: packages / 🧪 Unit Tests: Packages (1, 3)
• GitHub Check: code-quality / code-quality
• GitHub Check: 🛡️ E2E Auth Tests (full)

---

Walkthrough

Five GitHub Actions workflows now run Docker image pre-pull steps unconditionally. The changes remove checks for DOCKERHUB_USERNAME or DockerHub credentials. Existing image pull commands and retry logic remain unchanged.

Merge Risk: ⚪ Minimal · up to e0ad2

Fork pull requests will pre-pull testcontainer images without requiring DockerHub credentials, while authenticated login remains gated; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the CI change and identifies fork pull requests as the affected case.
Description check	✅ Passed	The description clearly explains the problem, evidence, intended fix, scope, and testing impact, but it omits the repository template sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/prepull-images-on-fork-prs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.