From 2766cf1e8e1bf488838fd22f2a8da8f7aab74624 Mon Sep 17 00:00:00 2001 From: Don Garrett Date: Wed, 7 Oct 2026 20:24:51 +0000 Subject: [PATCH] Release: the dev organization's registry, pushed by registry-push The repository moved to the dev organization: images go to gitea.dongar.net/dev/nisse-dev, pushed by the registry-push bot with the organization's REGISTRY_TOKEN. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE --- .gitea/workflows/release.yml | 17 ++++++++++------- docs/Development-Plan.md | 4 ++-- 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index 0a8e25a..000a06d 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -1,23 +1,26 @@ name: Release # A published release builds the agent's image and pushes it to Gitea's -# registry (Development Plan M1.5, X4): gitea.dongar.net/dongar/nisse-dev +# registry (Development Plan M1.5, X4): gitea.dongar.net/dev/nisse-dev # tagged with the version (the release tag without its v) and latest. Cut a # release in Gitea (Releases → New release, tag vX.Y.Z); a tag pushed for any # other reason builds nothing. # # The registry needs a personal access token with write:package -# (REGISTRY_TOKEN), never the built-in job token: Gitea's registry resolves -# an Actions job token to an empty package scope (go-gitea/gitea#23642 and -# others). Packages belong to the repository's owner. Never on pull_request: -# registry credentials stay off that trigger. +# (REGISTRY_TOKEN, an organization secret of `dev`, belonging to the +# registry-push bot), never the built-in job token: Gitea's registry +# resolves an Actions job token to an empty package scope (go-gitea/gitea +# #23642 and others). Packages belong to the repository's owner, which is +# why this repository is the `dev` organization's: the bot writes packages +# through the org's registry-push team. Never on pull_request: registry +# credentials stay off that trigger. on: release: types: [published] env: REGISTRY: gitea.dongar.net - REGISTRY_USER: dongar # the token's account - IMAGE: gitea.dongar.net/dongar/nisse-dev + REGISTRY_USER: registry-push # the token's account + IMAGE: gitea.dongar.net/dev/nisse-dev jobs: build-and-push: diff --git a/docs/Development-Plan.md b/docs/Development-Plan.md index 796a0c0..27e944d 100644 --- a/docs/Development-Plan.md +++ b/docs/Development-Plan.md @@ -281,8 +281,8 @@ accepted once a tag's image passes the e2e suite. mounted at `/etc/nisse-dev/nisse-dev.yaml`, secrets as environment variables, keys mounted read-only. Its `test` stage carries the tests over the installed package, for `scripts/e2e.sh --image REF`. CI builds both on every PR; - `release.yml` pushes `gitea.dongar.net/dongar/nisse-dev:` and `:latest` - (`REGISTRY_TOKEN`). + `release.yml` pushes `gitea.dongar.net/dev/nisse-dev:` and `:latest` + on a published release (`REGISTRY_TOKEN`, the `dev` organization's). - The live bring-up's switch to the image waits for the next live test (it needs its own test repository too); `bringup.sh plan` shows what it will run.