From 1940868891b3c1a046647dc6ea1d19a2a960555c Mon Sep 17 00:00:00 2001 From: mhenrixon Date: Mon, 10 Aug 2026 11:56:35 +0200 Subject: [PATCH] chore(ci): publish the image under ghcr.io/zoolutions The repo moved to the zoolutions org for enterprise Actions minutes, and a workflow's GITHUB_TOKEN can only write packages in its own owner namespace - pushing to the mhenrixon user package now fails with "permission_denied: The requested installation does not exist" (which is why v1.0.0.2 never published). Point the publish workflow, the release script and the docs at ghcr.io/zoolutions/kamal-proxy. The dash gem's repository defaults move in lockstep (zoolutions/kamal#109). --- .claude/rules/git-workflow.md | 2 +- .claude/rules/upstream-sync.md | 4 ++-- .github/workflows/docker-publish.yml | 4 ++-- CLAUDE.md | 8 ++++---- script/release-dash | 6 +++--- 5 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.claude/rules/git-workflow.md b/.claude/rules/git-workflow.md index f990002..0c18f9f 100644 --- a/.claude/rules/git-workflow.md +++ b/.claude/rules/git-workflow.md @@ -92,7 +92,7 @@ script/release-dash v1.0.0.0 # validates tag grammar, runs make test, tags, - **NEVER** `git push --tags` — single-tag pushes only, `git push origin tag v1.0.0.0` - **NEVER** hand-craft the tag — let `script/release-dash` validate the grammar and run the tests first -- Release the proxy image **before** the gem — the `dash` gem's `MINIMUM_VERSION` must name an already-published `ghcr.io/mhenrixon/kamal-proxy` tag. See `../kamal/CLAUDE.md` for gem-side ordering. +- Release the proxy image **before** the gem — the `dash` gem's `MINIMUM_VERSION` must name an already-published `ghcr.io/zoolutions/kamal-proxy` tag. See `../kamal/CLAUDE.md` for gem-side ordering. Sync mechanics (fetching upstream, merging into feature branches, the conflict playbook) live entirely in `.claude/rules/upstream-sync.md` — don't duplicate them here. diff --git a/.claude/rules/upstream-sync.md b/.claude/rules/upstream-sync.md index e9e19b3..ca2a248 100644 --- a/.claude/rules/upstream-sync.md +++ b/.claude/rules/upstream-sync.md @@ -39,8 +39,8 @@ git push origin dash ```bash git checkout dash script/release-dash v1.0.0.0 # validates vX.Y.Z.N grammar, make test, tags, pushes the tag -# CI publishes ghcr.io/mhenrixon/kamal-proxy:v1.0.0.0 (+ :latest) -docker buildx imagetools inspect ghcr.io/mhenrixon/kamal-proxy:v1.0.0.0 # verify amd64+arm64 +# CI publishes ghcr.io/zoolutions/kamal-proxy:v1.0.0.0 (+ :latest) +docker buildx imagetools inspect ghcr.io/zoolutions/kamal-proxy:v1.0.0.0 # verify amd64+arm64 ``` Pick the next number yourself — it reflects what shipped here, not what basecamp happened to tag. Then update `MINIMUM_VERSION` in the `dash` gem and release it (see that repo's `.claude/rules/upstream-sync.md`); the proxy image must be published first, because `MINIMUM_VERSION` has to name a tag that exists. diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 47cf1f7..562978a 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -61,5 +61,5 @@ jobs: labels: | org.opencontainers.image.title=kamal-proxy tags: | - ghcr.io/mhenrixon/kamal-proxy:latest - ghcr.io/mhenrixon/kamal-proxy:${{ steps.version-tag.outputs.value }} + ghcr.io/zoolutions/kamal-proxy:latest + ghcr.io/zoolutions/kamal-proxy:${{ steps.version-tag.outputs.value }} diff --git a/CLAUDE.md b/CLAUDE.md index 31a6556..f7449b8 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1,6 +1,6 @@ -# kamal-proxy (mhenrixon fork) +# kamal-proxy (zoolutions fork) -**dash-proxy.** Started as a fork of [basecamp/kamal-proxy](https://github.com/basecamp/kamal-proxy) and still merges their fixes forward via `main`, but the product is ours — their conventions are not constraints on ours. Carries the cert features they don't ship: SAN certificate batching and wildcard certs via DNS-01. Published as `ghcr.io/mhenrixon/kamal-proxy`; the Go module, binary, RPC service, and socket all stay `kamal-proxy` on purpose. Consumed by the `dash` gem fork in `../kamal`. +**dash-proxy.** Started as a fork of [basecamp/kamal-proxy](https://github.com/basecamp/kamal-proxy) and still merges their fixes forward via `main`, but the product is ours — their conventions are not constraints on ours. Carries the cert features they don't ship: SAN certificate batching and wildcard certs via DNS-01. Published as `ghcr.io/zoolutions/kamal-proxy`; the Go module, binary, RPC service, and socket all stay `kamal-proxy` on purpose. Consumed by the `dash` gem fork in `../kamal`. ## Tech Stack @@ -34,7 +34,7 @@ make build # Build bin/kamal-proxy make test # go test ./... make docker # Local image build (smoke test) script/release-dash v1.0.0.0 # Tag + push; CI publishes to ghcr -docker buildx imagetools inspect ghcr.io/mhenrixon/kamal-proxy:v1.0.0.0 # Verify multi-arch +docker buildx imagetools inspect ghcr.io/zoolutions/kamal-proxy:v1.0.0.0 # Verify multi-arch git fetch upstream --tags --prune # Start of every sync ``` @@ -71,7 +71,7 @@ The two cert branches deliberately overlap in run.go/config.go/router.go — the ## Release & image -Tag push (`vX.Y.Z.N`) → `.github/workflows/docker-publish.yml` → multi-arch build → `ghcr.io/mhenrixon/kamal-proxy:vX.Y.Z.N` + `:latest`. `GITHUB_TOKEN` authenticates; the ghcr package must stay PUBLIC (kamal deploys and integration tests pull anonymously). The kamal fork's `MINIMUM_VERSION` must always name a published tag — release here FIRST, then the gem. +Tag push (`vX.Y.Z.N`) → `.github/workflows/docker-publish.yml` → multi-arch build → `ghcr.io/zoolutions/kamal-proxy:vX.Y.Z.N` + `:latest`. `GITHUB_TOKEN` authenticates; the ghcr package must stay PUBLIC (kamal deploys and integration tests pull anonymously). The kamal fork's `MINIMUM_VERSION` must always name a published tag — release here FIRST, then the gem. ## Testing diff --git a/script/release-dash b/script/release-dash index e770697..6404a20 100755 --- a/script/release-dash +++ b/script/release-dash @@ -1,6 +1,6 @@ #!/bin/bash -# Release dash-proxy as ghcr.io/mhenrixon/kamal-proxy. +# Release dash-proxy as ghcr.io/zoolutions/kamal-proxy. # # Tags are four-segment: vX.Y.Z.N, e.g. v1.0.0.0. # @@ -47,5 +47,5 @@ make test git tag -a "${TAG}" -m "dash-proxy ${TAG}" git push origin "tag" "${TAG}" -echo "Tag ${TAG} pushed. CI will publish ghcr.io/mhenrixon/kamal-proxy:${TAG}" -echo "Verify with: docker buildx imagetools inspect ghcr.io/mhenrixon/kamal-proxy:${TAG}" +echo "Tag ${TAG} pushed. CI will publish ghcr.io/zoolutions/kamal-proxy:${TAG}" +echo "Verify with: docker buildx imagetools inspect ghcr.io/zoolutions/kamal-proxy:${TAG}"