CI: pull the Docker images logged in to Docker Hub

[Fedr]

The job containers were pulled from Docker Hub anonymously. On shared GitHub-hosted runner IPs that hits the unauthenticated pull rate limit. In this master run, nine jobs failed in "Initialize containers", and two more failed because they wait for generate-c-bindings:

docker pull meshlib/meshlib-ubuntu22-arm64:latest
Error response from daemon: toomanyrequests: You have reached your unauthenticated pull rate limit.

Every job container now logs in with the meshlib account and the existing DOCKERHUB_TOKEN secret, the one config.yml and prepare-images.yml already use:

container:
  image: meshlib/...
  credentials:
    username: meshlib
    password: ${{ secrets.DOCKERHUB_TOKEN }}

Affected jobs:

• build-test-ubuntu, build-test-linux-vcpkg, build-test-emscripten (3 jobs), build-test-emscripten-c-bindings
• generate-c-bindings
• the manylinux job in pip-build
• update-docs-manual

The reusable workflows that didn't receive secrets now get secrets: inherit from their callers:

• build-test-distribute.yml: generate-c-bindings, build-test-emscripten, build-test-emscripten-c-bindings and pip-build
• pip-build.yml: generate-c-bindings and build-test-emscripten
• distro-release.yml and update-docs-manual.yml: generate-c-bindings

When the secret is empty, as for fork PRs and Dependabot, the runner skips the login and pulls anonymously as before.

actions-ecosystem/action-get-latest-tag is a Docker action. GitHub builds its image FROM alpine:latest at job start even when the step is skipped, and that anonymous pull failed pip-build's setup job with 429 Too Many Requests (job). In pip-build.yml, release-tests.yml and sign-upload-nuget.yml it is replaced by a new composite action, .github/actions/get-latest-tag. It runs the original action's commands directly: git fetch --tags, unshallow, git describe --abbrev=0 --tags, and a v0.0.0 fallback. It has the same tag output.

The containers that pull public images now log in the same way, because those pulls count against the same anonymous limit:

• the wheel tests in pip-build
• the two Linux jobs in test-distribution, which now takes DOCKERHUB_TOKEN as an optional secret from build-test-distribute
• release-tests, called from pip-build with secrets: inherit
• pot-auto-update

🤖 Generated with Claude Code