Release: the dev organization's registry, pushed by registry-push

The repository moved to the dev organization: images go to
gitea.dongar.net/dev/nisse-dev, pushed by the registry-push bot with the
organization's REGISTRY_TOKEN.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

.gitea/workflows/release.yml

@@ -1,35 +1,63 @@
 name: Release
-# A tag v* publishes the agent's image to Gitea's registry (Development Plan
+# A published release builds the agent's image and pushes it to Gitea's
-# M1.5, X4): gitea.dongar.net/dongar/nisse-dev:<tag> and :latest. The token
+# registry (Development Plan M1.5, X4): gitea.dongar.net/dev/nisse-dev
-# is a secret (REGISTRY_TOKEN: write:package for REGISTRY_USER); the
+# tagged with the version (the release tag without its v) and latest. Cut a
-# account is a setting, so it's here.
+# release in Gitea (Releases → New release, tag vX.Y.Z); a tag pushed for any
+# other reason builds nothing.
+#
+# The registry needs a personal access token with write:package
+# (REGISTRY_TOKEN, an organization secret of `dev`, belonging to the
+# registry-push bot), never the built-in job token: Gitea's registry
+# resolves an Actions job token to an empty package scope (go-gitea/gitea
+# #23642 and others). Packages belong to the repository's owner, which is
+# why this repository is the `dev` organization's: the bot writes packages
+# through the org's registry-push team. Never on pull_request: registry
+# credentials stay off that trigger.
 on:
-  push:
+  release:
-    tags: ["v*"]
+    types: [published]
 
 env:
   REGISTRY: gitea.dongar.net
-  REGISTRY_USER: dongar
+  REGISTRY_USER: registry-push  # the token's account
-  IMAGE: gitea.dongar.net/dongar/nisse-dev
+  IMAGE: gitea.dongar.net/dev/nisse-dev
 
 jobs:
-  image:
+  build-and-push:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@v4
 
-      - name: Build
+      - name: Derive the image version from the release's tag
-        run: |
+        id: vars
-          docker build --target agent \
-            --label org.opencontainers.image.revision="${{ github.sha }}" \
-            --label org.opencontainers.image.version="${{ github.ref_name }}" \
-            -t "$IMAGE:${{ github.ref_name }}" -t "$IMAGE:latest" .
-
-      - name: Push
         env:
-          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          TAG: ${{ github.event.release.tag_name }}
-        run: |
+        run: echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
-          printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+
-          docker push "$IMAGE:${{ github.ref_name }}"
+      - name: Log in to Gitea's container registry
-          docker push "$IMAGE:latest"
+        uses: docker/login-action@v3
-          docker logout "$REGISTRY"
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ env.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push the agent
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          target: agent
+          push: true
+          build-args: |
+            VERSION=${{ steps.vars.outputs.version }}
+          labels: |
+            org.opencontainers.image.version=${{ steps.vars.outputs.version }}
+            org.opencontainers.image.revision=${{ github.sha }}
+          tags: |
+            ${{ env.IMAGE }}:${{ steps.vars.outputs.version }}
+            ${{ env.IMAGE }}:latest

Dockerfile

@@ -24,6 +24,8 @@ COPY nisse-ops nisse-ops
 RUN uv sync --frozen --no-dev --package nisse-dev --no-editable
 
 FROM python:3.12-slim AS runtime
+ARG VERSION=dev
+LABEL org.opencontainers.image.title=nisse-dev org.opencontainers.image.version=$VERSION
 RUN apt-get update \
     && apt-get install -y --no-install-recommends openssh-client \
     && rm -rf /var/lib/apt/lists/* \

docs/Development-Plan.md

@@ -281,8 +281,8 @@ accepted once a tag's image passes the e2e suite.
   mounted at `/etc/nisse-dev/nisse-dev.yaml`, secrets as environment variables,
   keys mounted read-only. Its `test` stage carries the tests over the installed
   package, for `scripts/e2e.sh --image REF`. CI builds both on every PR;
-  `release.yml` pushes `gitea.dongar.net/dongar/nisse-dev:<tag>` and `:latest`
+  `release.yml` pushes `gitea.dongar.net/dev/nisse-dev:<version>` and `:latest`
-  (`REGISTRY_TOKEN`).
+  on a published release (`REGISTRY_TOKEN`, the `dev` organization's).
 - The live bring-up's switch to the image waits for the next live test (it needs
   its own test repository too); `bringup.sh plan` shows what it will run.