I'm not sure why this isn't the default.

If this is to prevent early login for public pull then that could be handled with the scope property.

If this is needed, then why isn't it in registry auth config, per-registry?

Good point. I tested this and registry-auths presence is not a safe signal: on fork PRs the YAML can still be non-empty while secret values inside resolve to empty, so login fails. scope is useful per-registry, but it doesn't solve event/fork gating. For that reason I kept registry-login explicit (default auto to preserve current behavior), and callers can opt-in with a fork-safe condition like:

registry-login: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}

This is similar to what we do in our repos like https://github.com/moby/buildkit-bench/blob/0ba0908a5f906bc469d6ebdca9731942432c81c9/.github/workflows/ci.yml#L81 but here we gate the login-action.

Alternatively we would have a new skip attribute in registry-auths yaml object like:

    secrets:
      registry-auths: |
        - registry: docker.io
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          skip: ${{ github.event_name = 'pull_request' }}

Or enable:

    secrets:
      registry-auths: |
        - registry: docker.io
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          enable: ${{ github.event_name != 'pull_request' }}

WDYT?