fix(ci): build-oci-image pushes to the private org registry #109

Merged

David merged 1 commit from fix/build-oci-image-private-package-org into main

2026-05-15 02:48:52 +02:00

David commented

2026-05-15 02:45:14 +02:00

Owner

Summary

Same gap PR #107 closed for publish-release.yml, on a workflow that should have been swept up in that same pass: build-oci-image.yml was deriving the registry owner from GITHUB_REPOSITORY_OWNER and authenticating with secrets.FORGEJO_PAT, neither of which is the org-standard pair. The last run pushed the OCI image to dev.a8n.run/${repo_owner}/lets-chat:latest instead of the shared a8n-tools private registry namespace consumers actually pull from.

Changes

.forgejo/workflows/build-oci-image.yml:

Add REGISTRY_OWNER: ${{ vars.A8N_TOOLS_PRIVATE_PACKAGE_OWNER }} to the job env.
Swap REGISTRY_PASSWORD: ${{ secrets.FORGEJO_PAT }} -> ${{ secrets.A8N_TOOLS_PRIVATE_PACKAGE_PAT }}.
"Set environment variables" step reads REGISTRY_OWNER directly instead of lowercasing GITHUB_REPOSITORY_OWNER. IMAGE_REGISTRY keeps the same shape, ${REGISTRY_PROVIDER}/${owner}, so the build/push step is untouched.

Audit

Grepped every workflow in .forgejo/workflows/ for FORGEJO_PAT / GITHUB_REPOSITORY_OWNER / registry secrets:

build-oci-image.yml -> on the old pattern, fixed here.
publish-release.yml -> already on the new pattern from #107.
build-desktop-linux.yml, build-desktop-windows.yml -> no registry push. They upload the binary to the workflow run via upload-artifact for CI inspection only; the actual package push happens in publish-release.yml on v* tags.
check.yml -> no registry push, just runs just check.

Test plan

Diff matches the auth/owner pattern in backup/.forgejo/workflows/build-oci-image.yml, eform/.forgejo/workflows/build-oci-image.yml, etc.
Next main push or v* tag has the OCI image appear at dev.a8n.run/${vars.A8N_TOOLS_PRIVATE_PACKAGE_OWNER}/lets-chat:<tags> and consumers can docker pull from there.

## Summary Same gap PR #107 closed for `publish-release.yml`, on a workflow that should have been swept up in that same pass: `build-oci-image.yml` was deriving the registry owner from `GITHUB_REPOSITORY_OWNER` and authenticating with `secrets.FORGEJO_PAT`, neither of which is the org-standard pair. The last run pushed the OCI image to `dev.a8n.run/${repo_owner}/lets-chat:latest` instead of the shared a8n-tools private registry namespace consumers actually pull from. ## Changes `.forgejo/workflows/build-oci-image.yml`: - Add `REGISTRY_OWNER: ${{ vars.A8N_TOOLS_PRIVATE_PACKAGE_OWNER }}` to the job env. - Swap `REGISTRY_PASSWORD: ${{ secrets.FORGEJO_PAT }}` -> `${{ secrets.A8N_TOOLS_PRIVATE_PACKAGE_PAT }}`. - "Set environment variables" step reads `REGISTRY_OWNER` directly instead of lowercasing `GITHUB_REPOSITORY_OWNER`. `IMAGE_REGISTRY` keeps the same shape, `${REGISTRY_PROVIDER}/${owner}`, so the build/push step is untouched. ## Audit Grepped every workflow in `.forgejo/workflows/` for `FORGEJO_PAT` / `GITHUB_REPOSITORY_OWNER` / registry secrets: - `build-oci-image.yml` -> on the old pattern, fixed here. - `publish-release.yml` -> already on the new pattern from #107. - `build-desktop-linux.yml`, `build-desktop-windows.yml` -> no registry push. They upload the binary to the workflow run via `upload-artifact` for CI inspection only; the actual package push happens in `publish-release.yml` on `v*` tags. - `check.yml` -> no registry push, just runs `just check`. ## Test plan - [x] Diff matches the auth/owner pattern in `backup/.forgejo/workflows/build-oci-image.yml`, `eform/.forgejo/workflows/build-oci-image.yml`, etc. - [ ] Next `main` push or `v*` tag has the OCI image appear at `dev.a8n.run/${vars.A8N_TOOLS_PRIVATE_PACKAGE_OWNER}/lets-chat:<tags>` and consumers can `docker pull` from there.

David added 1 commit

2026-05-15 02:45:14 +02:00

fix(ci): build-oci-image pushes to the private org registry

Check / clippy + fmt + tests (pull_request) Successful in 1m7s

Details

820942fcea

Same gap PR #107 closed for `publish-release.yml`, on a workflow I should have caught in the same pass: `build-oci-image.yml` was deriving the registry owner from `GITHUB_REPOSITORY_OWNER` and authenticating with `secrets.FORGEJO_PAT`, neither of which is the org-standard pair. The last run pushed the OCI image to `dev.a8n.run/${repo_owner}/lets-chat:latest` instead of the shared a8n-tools private registry namespace consumers actually pull from.

Match the pattern every other repo under `~/projects/a8n-run/` uses (backup, eform, saas, storefront, file-explorer, rusty-links, icanhazrust, ...):

- Add `REGISTRY_OWNER: ${{ vars.A8N_TOOLS_PRIVATE_PACKAGE_OWNER }}` to the job env.
- Swap `REGISTRY_PASSWORD: ${{ secrets.FORGEJO_PAT }}` -> `${{ secrets.A8N_TOOLS_PRIVATE_PACKAGE_PAT }}`.
- Rewrite the "Set environment variables" step to read `REGISTRY_OWNER` directly instead of lowercasing `GITHUB_REPOSITORY_OWNER`. `IMAGE_REGISTRY` keeps the same shape, `${REGISTRY_PROVIDER}/${owner}`, so the build/push step is untouched and the produced tag list and cache-from URL still resolve - just under the shared-org namespace.

`build-desktop-linux.yml`, `build-desktop-windows.yml`, and `check.yml` were audited and do not push to any registry (the desktop workflows attach the binary to the workflow run via `upload-artifact` for CI inspection only; the actual package push happens in `publish-release.yml` on `v*` tags, already fixed by #107). So this PR is scoped to `build-oci-image.yml`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>