larvit/fejkdata
3
0
Fork 0
Code Pull Requests 1 Actions Activity

Answer architecture round 2: 0 🔴, 0 🟡; tie the token choice to the account type, and keep GHCR's reason in the registry decision

Browse Source
This commit is contained in:
Lilleman auf Larv
2026-10-14 11:19:30 +02:00
committed by Lillem4n
parent 508e93d11a
commit fbadb99634
2 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+3 -2
View File
@@ -1284,8 +1284,9 @@ binaries and packages, pushes the image to GHCR and copies it to Docker Hub, upd
Homebrew tap and the Scoop bucket, and deploys the apt, dnf and apk repositories to GitHub
Pages. The workflow reads these repository secrets:
- `DOCKERHUB_TOKEN`: a Docker Hub access token with Read & Write and no Delete, or an
organization token that can push only to `larvit/fejkdata`. The repository variable
- `DOCKERHUB_TOKEN`: where `larvit` is a Docker Hub organization, an organization token
that can push only to `larvit/fejkdata`; otherwise a personal token with Read & Write and
no Delete, which reaches every repository the account can write. The repository variable
`DOCKERHUB_USERNAME` names its account.
- `PACKAGES_GPG_KEY`, `PACKAGES_RSA_KEY`: the private keys that sign the repositories.
- `TAP_GITHUB_TOKEN`: a token that can push to `larvit/homebrew-tap` and
docs/decisions.md
+7 -5
View File
@@ -982,8 +982,10 @@ Valid while GitHub hosts the code.
2026-10-14, decided by the maintainer. Serves goal 1.1; technical principle: prefer the
vendor-neutral option (`~/.claude/principles/technical-principles.md`). Docker Hub is
Docker's default registry, so `docker run larvit/fejkdata` works with no host in the name;
that is a capability only Docker Hub has. GHCR stays the image's source: GoReleaser pushes
there, and a job of its own copies the image to Docker Hub, so a Docker Hub failure holds up
no other channel. GHCR also serves CI on shared runners, which Docker Hub's per-IP limit on
anonymous pulls blocks. Leaving Docker Hub costs each user an edit of every `docker run` line
and pinned script that names the bare `larvit/fejkdata`.
that is a capability only Docker Hub has. GHCR stays the image's source, and adds no
vendor while GitHub hosts the code; being OCI, the image moves to another registry by a
change of path. GoReleaser pushes there, and a job of its own copies the image to Docker
Hub, so a Docker Hub failure holds up no other channel. GHCR also serves CI on shared
runners, which Docker Hub's per-IP limit on anonymous pulls blocks. Leaving Docker Hub
costs each user an edit of every `docker run` line and pinned script that names the bare
`larvit/fejkdata`.