From 5345798dc1ecf13a9be2a845c397e5a0372e3b7a Mon Sep 17 00:00:00 2001 From: Holden Date: Fri, 12 Jun 2026 18:53:26 +0000 Subject: [PATCH] ci: enforce GHCR package visibility public after each push GHCR packages default private on first creation. Add a best-effort gh api PATCH call at the end of both the multi-arch merge job and the cpu build job so any new package version is immediately public without requiring a manual UI step. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/docker-publish.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 69d5541..e075712 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -131,6 +131,13 @@ jobs: run: | docker buildx imagetools inspect ${{ steps.tags.outputs.tags }} + - name: Ensure package is public + run: | + gh api -X PATCH /user/packages/container/winnow \ + -f visibility=public || true + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + build-cpu: name: Build CPU-only (amd64) runs-on: ubuntu-latest @@ -185,3 +192,10 @@ jobs: - name: Inspect CPU image run: | docker buildx imagetools inspect ${{ steps.cpu-tag.outputs.tag }} + + - name: Ensure package is public + run: | + gh api -X PATCH /user/packages/container/winnow \ + -f visibility=public || true + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}