chore: switch container registry to quay.io

.github/workflows/images.yml

@@ -11,8 +11,8 @@ permissions:
   packages: write
 
 env:
-  REGISTRY: ghcr.io
-  IMAGE_BASE: ghcr.io/${{ github.repository }}
+  REGISTRY: quay.io
+  IMAGE_BASE: quay.io/rcochran/openshell
 
 jobs:
   sandbox:
@@ -26,8 +26,8 @@ jobs:
       - uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          username: ${{ secrets.REGISTRY_QUAY_USER }}
+          password: ${{ secrets.REGISTRY_QUAY_PASSWORD }}
       - name: Compute version tag
         id: version
         run: echo "version=$(git describe --tags --always 2>/dev/null || echo dev)" >> "$GITHUB_OUTPUT"
@@ -38,8 +38,6 @@ jobs:
           tags: |
             type=semver,pattern=sandbox-v{{version}}
             type=raw,value=sandbox-${{ steps.version.outputs.version }},enable=${{ github.ref_type != 'tag' }}
-      # Fork PRs can't write to the registry; same-repo PRs push so the
-      # integration (kind) job can pull the image without a local preload.
       - uses: docker/build-push-action@v6
         with:
           context: profiles/images/sandbox-default

Makefile

@@ -12,7 +12,7 @@
 ##   make dev-push          # build + push sandbox image (multi-arch)
 ## Release images are built and pushed by .github/workflows/images.yml.
 
-REGISTRY      ?= ghcr.io/robbycochran/harness-openshell
+REGISTRY      ?= quay.io/rcochran/openshell
 CONTAINER_CLI ?= podman
 PLATFORM      := linux/amd64
 VERSION       := $(shell git describe --tags --always 2>/dev/null || echo dev)

SPEC.md

@@ -151,7 +151,7 @@ These commands still work but will be removed in a future release:
 
 ## Image Tags
 
-All images are published to `ghcr.io/robbycochran/harness-openshell`. CI never publishes floating tags (`:latest`, `:sandbox`); the bare `:sandbox` fallback below exists only for local `go build` binaries without version ldflags.
+All images are published to `quay.io/rcochran/openshell`. CI never publishes floating tags (`:latest`, `:sandbox`); the bare `:sandbox` fallback below exists only for local `go build` binaries without version ldflags.
 
 | Trigger | Sandbox |
 |---------|---------|

cmd/resolve.go

@@ -105,7 +105,7 @@ func resolveGatewayConfigWithHarness(harnessDir, name string, h *agent.Harness)
 }
 
 func versionedImage(name string) string {
-	base := "ghcr.io/robbycochran/harness-openshell"
+	base := "quay.io/rcochran/openshell"
 	if Version == "" || Version == "dev" {
 		return base + ":" + name
 	}

scripts/dev-harness.sh

@@ -27,7 +27,7 @@ if [[ -z "${HARNESS_OS_IMAGE:-}" ]]; then
         --jq '[.[].metadata.container.tags[] | select(startswith("sandbox-v"))] | first // empty' 2>/dev/null || true)
 
     if [[ -n "$LATEST_TAG" ]]; then
-        export HARNESS_OS_IMAGE="ghcr.io/robbycochran/harness-openshell:${LATEST_TAG}"
+        export HARNESS_OS_IMAGE="quay.io/rcochran/openshell:${LATEST_TAG}"
     else
         echo "WARNING: could not find CI image, using version-based default" >&2
     fi