From 5d7d6e03a28f6b5185f603b58fe58f25fae60900 Mon Sep 17 00:00:00 2001 From: Robby Cochran Date: Wed, 17 Jun 2026 16:10:40 -0700 Subject: [PATCH] chore: switch container registry from ghcr.io to quay.io/rcochran/openshell CI uses REGISTRY_QUAY_USER and REGISTRY_QUAY_PASSWORD secrets to authenticate with quay.io. All image references updated: code, Makefile, CI workflows, SPEC, dev scripts. --- .github/workflows/images.yml | 10 ++++------ Makefile | 2 +- SPEC.md | 2 +- cmd/resolve.go | 2 +- scripts/dev-harness.sh | 2 +- 5 files changed, 8 insertions(+), 10 deletions(-) diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml index 2aec297..3ecdb67 100644 --- a/.github/workflows/images.yml +++ b/.github/workflows/images.yml @@ -11,8 +11,8 @@ permissions: packages: write env: - REGISTRY: ghcr.io - IMAGE_BASE: ghcr.io/${{ github.repository }} + REGISTRY: quay.io + IMAGE_BASE: quay.io/rcochran/openshell jobs: sandbox: @@ -26,8 +26,8 @@ jobs: - uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + username: ${{ secrets.REGISTRY_QUAY_USER }} + password: ${{ secrets.REGISTRY_QUAY_PASSWORD }} - name: Compute version tag id: version run: echo "version=$(git describe --tags --always 2>/dev/null || echo dev)" >> "$GITHUB_OUTPUT" @@ -38,8 +38,6 @@ jobs: tags: | type=semver,pattern=sandbox-v{{version}} type=raw,value=sandbox-${{ steps.version.outputs.version }},enable=${{ github.ref_type != 'tag' }} - # Fork PRs can't write to the registry; same-repo PRs push so the - # integration (kind) job can pull the image without a local preload. - uses: docker/build-push-action@v6 with: context: profiles/images/sandbox-default diff --git a/Makefile b/Makefile index 1d1f021..dcf43bd 100644 --- a/Makefile +++ b/Makefile @@ -12,7 +12,7 @@ ## make dev-push # build + push sandbox image (multi-arch) ## Release images are built and pushed by .github/workflows/images.yml. -REGISTRY ?= ghcr.io/robbycochran/harness-openshell +REGISTRY ?= quay.io/rcochran/openshell CONTAINER_CLI ?= podman PLATFORM := linux/amd64 VERSION := $(shell git describe --tags --always 2>/dev/null || echo dev) diff --git a/SPEC.md b/SPEC.md index ae8dce9..8cb572c 100644 --- a/SPEC.md +++ b/SPEC.md @@ -151,7 +151,7 @@ These commands still work but will be removed in a future release: ## Image Tags -All images are published to `ghcr.io/robbycochran/harness-openshell`. CI never publishes floating tags (`:latest`, `:sandbox`); the bare `:sandbox` fallback below exists only for local `go build` binaries without version ldflags. +All images are published to `quay.io/rcochran/openshell`. CI never publishes floating tags (`:latest`, `:sandbox`); the bare `:sandbox` fallback below exists only for local `go build` binaries without version ldflags. | Trigger | Sandbox | |---------|---------| diff --git a/cmd/resolve.go b/cmd/resolve.go index eb3122f..73c70a3 100644 --- a/cmd/resolve.go +++ b/cmd/resolve.go @@ -105,7 +105,7 @@ func resolveGatewayConfigWithHarness(harnessDir, name string, h *agent.Harness) } func versionedImage(name string) string { - base := "ghcr.io/robbycochran/harness-openshell" + base := "quay.io/rcochran/openshell" if Version == "" || Version == "dev" { return base + ":" + name } diff --git a/scripts/dev-harness.sh b/scripts/dev-harness.sh index 5391210..94aa278 100755 --- a/scripts/dev-harness.sh +++ b/scripts/dev-harness.sh @@ -27,7 +27,7 @@ if [[ -z "${HARNESS_OS_IMAGE:-}" ]]; then --jq '[.[].metadata.container.tags[] | select(startswith("sandbox-v"))] | first // empty' 2>/dev/null || true) if [[ -n "$LATEST_TAG" ]]; then - export HARNESS_OS_IMAGE="ghcr.io/robbycochran/harness-openshell:${LATEST_TAG}" + export HARNESS_OS_IMAGE="quay.io/rcochran/openshell:${LATEST_TAG}" else echo "WARNING: could not find CI image, using version-based default" >&2 fi