larvit/fejkdata
3
0
Fork 0
Code Pull Requests 1 Actions Activity

Answer architecture round 1: 0 🔴, 3 🟡; copy the image to Docker Hub in a job of its own, give the registries their own decision, and name the narrowest token

Browse Source
This commit is contained in:
Lilleman auf Larv
2026-10-14 11:18:32 +02:00
committed by Lillem4n
parent f3fbbac0d9
commit 508e93d11a
7 changed files with 58 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+13 -12
View File
@@ -42,8 +42,8 @@ docker run --rm -i larvit/fejkdata < template.json # any OS with
go install github.com/larvit/fejkdata/cmd/fejkdata@latest # any OS with Go
```
The image is also `ghcr.io/larvit/fejkdata`, which CI on shared runners may prefer:
Docker Hub limits anonymous pulls per IP address.
On shared CI runners, pull `ghcr.io/larvit/fejkdata` instead: Docker Hub limits anonymous
pulls per IP address.
Debian, Ubuntu, Fedora, RHEL and Alpine install from fejkdata's signed repositories, which
hold the latest release:
@@ -1280,21 +1280,22 @@ To release, head `CHANGELOG.md` with the version's section in place of `Unreleas
and merge: once `main` passes the gate, CI tags that commit `vX.Y.Z` and publishes
the GitHub release with the section as its body. A top heading of `[Unreleased]`
publishes nothing. CI then runs the Packages workflow on the new tag, which attaches the
binaries and packages, pushes the image to Docker Hub and GHCR, updates the Homebrew tap and the Scoop bucket,
and deploys the apt, dnf and apk repositories to GitHub Pages. The workflow reads
these repository secrets:
binaries and packages, pushes the image to GHCR and copies it to Docker Hub, updates the
Homebrew tap and the Scoop bucket, and deploys the apt, dnf and apk repositories to GitHub
Pages. The workflow reads these repository secrets:
- `DOCKERHUB_USERNAME`, `DOCKERHUB_TOKEN`: a Docker Hub account and access token that can
push to `larvit/fejkdata`.
- `DOCKERHUB_TOKEN`: a Docker Hub access token with Read & Write and no Delete, or an
organization token that can push only to `larvit/fejkdata`. The repository variable
`DOCKERHUB_USERNAME` names its account.
- `PACKAGES_GPG_KEY`, `PACKAGES_RSA_KEY`: the private keys that sign the repositories.
- `TAP_GITHUB_TOKEN`: a token that can push to `larvit/homebrew-tap` and
`larvit/scoop-bucket`.
The image's Docker Hub repository and GHCR package must be public, and Pages must deploy from GitHub Actions. To
package a release again,
run the workflow by hand with its tag; it replaces what it uploaded before. For a tag older
than the latest release it leaves the tap, the bucket, the images' `latest` and
the repositories alone, since each holds one version.
The image's Docker Hub repository and GHCR package must be public, and Pages must deploy
from GitHub Actions. To package a release again, run the workflow by hand with its tag; it
replaces what it uploaded before. For a tag older than the latest release it leaves the
tap, the bucket, the image's `latest` tags and the repositories alone, since each holds one
version.
## License