Repository navigation
feat(release): publish to GHCR with GITHUB_TOKEN when the registry secrets are empty (DF15b) - #5
Merged
Merged
Conversation
…crets are empty (DF15b) - release-features.sh publish: on OCI_REGISTRY=ghcr.io with neither OCI_REGISTRY_USERNAME nor OCI_REGISTRY_PASSWORD set, authenticate with GITHUB_TOKEN as GITHUB_ACTOR via DEVCONTAINERS_OCI_AUTH; explicit secrets still win - keep the failure modes: one secret only, non-ghcr without secrets, ghcr without secrets or GITHUB_TOKEN (names packages: write) - ADR 0004: dated amendment (Decision text left as accepted, per docs/adrs/README.md) - README: GHCR publishing needs only the OCI_REGISTRY variable once base's release.yml grants packages: write
…, clearer one-secret errors (DF15b) - publish: on a CLI failure, die naming the auth source; in GITHUB_TOKEN mode also packages: write and per-package Manage Actions access - one-secret errors say to set both or, on ghcr.io, delete both - README: migration from the secrets, per-package Actions access
…eding 0004 (DF15b) - new ADR 0005; 0004 keeps only a Status pointer (in-place amendment removed) - README links ADR 0005
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
release-features.sh publishauthenticates to GHCR with the release job'sGITHUB_TOKEN(asGITHUB_ACTOR) whenOCI_REGISTRY=ghcr.ioand theOCI_REGISTRY_USERNAME/OCI_REGISTRY_PASSWORDsecrets are empty. Explicit secrets still win, and both are required when either is set. Any other registry still needs the secrets. The credential reaches the Dev Container CLI only throughDEVCONTAINERS_OCI_AUTH(registry|user|token, checked against @devcontainers/cli 0.89.0), andGITHUB_TOKENis removed from the CLI's environment.GITHUB_TOKENmode it also names the two likely causes: the build job'spackages: write, and each existing package's "Manage Actions access".Depends on: template-base's DF15a release (
packages: writeonrelease.yml'sbuildjob) reaching this repo through template-sync. Until then, a full release with empty secrets can't push withGITHUB_TOKEN: GHCR denies the push, andmake publishfails with the hint.