ci: publish node images to a public registry on a version tag (DISABLED) #8

2026-09-06T22:39:44-04:00

logan commented

2026-09-06 22:39:44 -04:00

git.vpn.cusano.net is now behind REQUIRE_SIGNIN_VIEW (INCIDENT-2026-09-06 — distributed scraper botnet), so a fresh Pi can no longer anonymously docker pull the node images or curl install.sh. Owner picked option 3: on a v* tag, build the three node images and push them to a public registry; source + the private Gitea registry stay walled.

This workflow is wired but INERT. The publish job is gated on vars.NODE_PUBLIC_PUBLISH == 'true' (unset), so it triggers on tags and skips. No if: false — the variable is the switch.

To enable later (documented in the file header):

vars: NODE_PUBLIC_PUBLISH=true, PUBLIC_REGISTRY (e.g. ghcr.io), PUBLIC_NAMESPACE
secrets: PUBLIC_REGISTRY_USER, PUBLIC_REGISTRY_TOKEN

Builds all three (edge-node, icecast, op25-client) arm64 via a matrix, reuses the existing Gitea :buildcache refs so op25 doesn't recompile from scratch, pushes <ns>/drb-<name>:<version> + :latest.

Not turning it on now — still building the core. Follow-on when self-serve node install is actually needed: also serve install.sh + a repo tarball publicly, and point install.sh / the mint panel at the public image names.

🤖 Generated with Claude Code

`git.vpn.cusano.net` is now behind `REQUIRE_SIGNIN_VIEW` (INCIDENT-2026-09-06 — distributed scraper botnet), so a fresh Pi can no longer anonymously `docker pull` the node images or `curl` install.sh. Owner picked option 3: on a `v*` tag, build the three node images and push them to a **public** registry; source + the private Gitea registry stay walled. **This workflow is wired but INERT.** The `publish` job is gated on `vars.NODE_PUBLIC_PUBLISH == 'true'` (unset), so it triggers on tags and skips. No `if: false` — the variable is the switch. To enable later (documented in the file header): - vars: `NODE_PUBLIC_PUBLISH=true`, `PUBLIC_REGISTRY` (e.g. `ghcr.io`), `PUBLIC_NAMESPACE` - secrets: `PUBLIC_REGISTRY_USER`, `PUBLIC_REGISTRY_TOKEN` Builds all three (edge-node, icecast, op25-client) arm64 via a matrix, reuses the existing Gitea `:buildcache` refs so op25 doesn't recompile from scratch, pushes `<ns>/drb-<name>:<version>` + `:latest`. Not turning it on now — still building the core. Follow-on when self-serve node install is actually needed: also serve `install.sh` + a repo tarball publicly, and point `install.sh` / the mint panel at the public image names. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

logan added 1 commit 2026-09-06 22:39:44 -04:00

ci: workflow to publish node images to a public registry on a version tag (DISABLED)

CI / lint (pull_request) Successful in 6s

Details

CI / lint (push) Successful in 7s

Details

CI / test (pull_request) Successful in 37s

Details

CI / test (push) Successful in 39s

Details

bee9e173e6

git.vpn.cusano.net is now behind REQUIRE_SIGNIN_VIEW (INCIDENT-2026-09-06),
so a fresh Pi can no longer anonymously `docker pull` the node images or
fetch install.sh. Plan (owner, option 3): on a `v*` tag, build the three
node images (edge-node, icecast, op25-client, arm64) and push them to a
PUBLIC registry; source and the private Gitea registry stay walled.

This workflow is wired but INERT — the job is gated on
`vars.NODE_PUBLIC_PUBLISH == 'true'`, which is unset. It triggers on tags
and skips. Enabling is three repo variables + two secrets, documented in the
file header; no code change. Reuses the existing Gitea buildcache refs so
op25 doesn't recompile from scratch.

Not turning it on now — still building the core.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

logan merged commit a53000a092 into main

2026-09-06 23:49:03 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: logan/node-26#8