Answer architecture round 2: 0 🔴, 0 🟡; tie the token choice to the account type, and keep GHCR's reason in the registry decision

This commit is contained in:
2026-10-14 11:19:30 +02:00
committed by Lillem4n
parent 508e93d11a
commit fbadb99634
2 changed files with 10 additions and 7 deletions
+3 -2
View File
@@ -1284,8 +1284,9 @@ binaries and packages, pushes the image to GHCR and copies it to Docker Hub, upd
Homebrew tap and the Scoop bucket, and deploys the apt, dnf and apk repositories to GitHub
Pages. The workflow reads these repository secrets:
- `DOCKERHUB_TOKEN`: a Docker Hub access token with Read & Write and no Delete, or an
organization token that can push only to `larvit/fejkdata`. The repository variable
- `DOCKERHUB_TOKEN`: where `larvit` is a Docker Hub organization, an organization token
that can push only to `larvit/fejkdata`; otherwise a personal token with Read & Write and
no Delete, which reaches every repository the account can write. The repository variable
`DOCKERHUB_USERNAME` names its account.
- `PACKAGES_GPG_KEY`, `PACKAGES_RSA_KEY`: the private keys that sign the repositories.
- `TAP_GITHUB_TOKEN`: a token that can push to `larvit/homebrew-tap` and