lux/docs
2
0
Fork 0
mirror of https://github.com/luxfi/docs.git synced 2026-09-24 00:25:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: push ghcr.io/lux-apps/lux-docs via native GITHUB_TOKEN

Browse Source 
Image path now matches the repo (lux-apps/lux-docs), so the build pushes
same-org with the workflow's GITHUB_TOKEN (packages: write) instead of the
cross-org GHCR_LUXFI_TOKEN PAT. Package will be made public to mirror the
old luxfi/lux-docs pull model. runs-on: lux-apps-build unchanged.
This commit is contained in:
zeekay
2026-06-27 17:02:56 -07:00
parent f30f9431df
commit fd127a9b7c
1 changed files with 12 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/docker.yml
+12 -14
View File
@@ -9,20 +9,18 @@ name: Docker
# matches on the scale-set name, not the classic # matches on the scale-set name, not the classic
# [self-hosted,linux,amd64] labels. # [self-hosted,linux,amd64] labels.
# #
# Image name is ghcr.io/luxfi/lux-docs — the exact name the live # Image name is ghcr.io/lux-apps/lux-docs — it matches this repo's path
# deployment (lux-ns/lux-docs, imagePullPolicy: Always) pulls as :latest. # (lux-apps/lux-docs), so the live deployment (lux-ns/lux-docs,
# Single-arch amd64: the base image ghcr.io/hanzoai/spa is amd64-only # imagePullPolicy: Always) pulls it as :latest. Single-arch amd64: the
# (hanzo ARC arm64 runners paused on DOKS), same constraint as the # base image ghcr.io/hanzoai/spa is amd64-only (hanzo ARC arm64 runners
# lux-apps marketing sites. # paused on DOKS), same constraint as the lux-apps marketing sites.
# #
# The Dockerfile is self-contained (node:22-alpine build of apps/docs → # The Dockerfile is self-contained (node:22-alpine build of apps/docs →
# static export → ghcr.io/hanzoai/spa). @hanzo/docs resolves from public # static export → ghcr.io/hanzoai/spa). @hanzo/docs resolves from public
# npm. Pushing to ghcr.io/luxfi/lux-docs is cross-org — this repo lives in # npm. Because the image and this repo share the lux-apps org, the GHCR
# lux-apps, so the lux-apps GITHUB_TOKEN cannot write the luxfi-owned # login uses the workflow's native GITHUB_TOKEN (packages: write, granted
# package (GitHub: "permission_denied: installation does not exist"). The # below) — no cross-org PAT. The package is public — mirroring the old
# GHCR login therefore uses GHCR_LUXFI_TOKEN, a luxfi write:packages token # luxfi/lux-docs — so the cluster pulls it without a registry credential.
# (user hanzo-dev, KMS-sourced from kms-build/ghcr-luxfi-push), set as a
# repo Actions secret on lux-apps/docs.
on: on:
workflow_dispatch: workflow_dispatch:
@@ -55,14 +53,14 @@ jobs:
uses: docker/login-action@v3 uses: docker/login-action@v3
with: with:
registry: ghcr.io registry: ghcr.io
username: hanzo-dev username: ${{ github.actor }}
password: ${{ secrets.GHCR_LUXFI_TOKEN }} password: ${{ secrets.GITHUB_TOKEN }}
- name: Image metadata - name: Image metadata
id: meta id: meta
uses: docker/metadata-action@v5 uses: docker/metadata-action@v5
with: with:
images: ghcr.io/luxfi/lux-docs images: ghcr.io/lux-apps/lux-docs
# :latest tracks main (the deployment pins :latest), plus an # :latest tracks main (the deployment pins :latest), plus an
# immutable :sha-<sha7> for traceability and a :{{version}} tag # immutable :sha-<sha7> for traceability and a :{{version}} tag
# on v* releases. # on v* releases.