From be149597e628167e58731857c135782bf6e568ca Mon Sep 17 00:00:00 2001 From: chris-young Date: Thu, 2 Apr 2026 11:31:41 -0700 Subject: [PATCH] Set GHCR package visibility to public on every release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GHCR defaults new packages to private, so docker pull ghcr.io/rightnow-ai/openfang:... returned 401 for unauthenticated users despite the repo being public. Two changes to the docker job in release.yml: 1. Add OCI labels to the build — links the package to the repo so GHCR associates it correctly, and is standard practice for container images. 2. After each push, call the GitHub Packages API (PATCH /orgs/RightNow-AI/packages/container/openfang) to set visibility to public. The workflow already holds packages: write, which is the required scope. This runs on every release tag so visibility cannot regress if the package is ever reset. Fixes #961 --- .github/workflows/release.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cd403289..759a36e8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -235,5 +235,17 @@ jobs: tags: | ghcr.io/rightnow-ai/openfang:latest ghcr.io/rightnow-ai/openfang:${{ steps.version.outputs.version }} + labels: | + org.opencontainers.image.source=https://github.com/RightNow-AI/openfang + org.opencontainers.image.licenses=MIT + org.opencontainers.image.description=OpenFang Agent OS — single-binary Rust agent framework cache-from: type=gha cache-to: type=gha,mode=max + - name: Set GHCR package visibility to public + run: | + curl -fsSL -X PATCH \ + -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \ + -H "Accept: application/vnd.github+json" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + https://api.github.com/orgs/RightNow-AI/packages/container/openfang \ + -d '{"visibility":"public"}'