fix/macos-private-registry #18

Merged

endmin merged 2 commits from fix/macos-private-registry into main 2026-09-27 16:25:36 +00:00

Conversation 0 Commits 2 Files changed 12 +404 -73

endmin commented 2026-09-27 16:25:32 +00:00

Owner

Copy link

No description provided.

endmin added 2 commits 2026-09-27 16:25:32 +00:00

fix(macos): keep gbb-macos under a private owner ... beb9b38215

A Forgejo package has no visibility of its own; it is exactly as public as
its owner. gbb-macos was pushed under the public studioteal org, so the
image -- and the Apple SDK inside it -- was anonymously pullable. The docs
had told operators to "set the package to private", a setting that does
not exist.

- build.macos_image_prefix (GBB_MACOS_IMAGE_PREFIX) names the macOS build
  image's owner separately; empty falls back to image_prefix. The mono
  glue image and other platforms keep image_prefix. The deployed configmap
  points it at the private studioteal-private org on the same host, so
  build.registry's one credential pulls both.
- push-macos-image.sh pushes there, refuses an owner the Forgejo API shows
  as public or limited, and after pushing fetches the manifest anonymously
  and fails if that succeeds.
- It also defaults the tag to the latest release: a release tag predates
  the commit that pins build.image_tag, so from a tag checkout the
  configmap named the previous version and the script refused.
- A failed pull of the macOS image now points at push-macos-image.sh
  rather than `make images`, which builds nothing a cluster can pull.

Config loading rejects unknown keys, so the configmap must roll out with
the server image that knows macos_image_prefix, i.e. with a release.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(macos): push and pull gbb-macos as endmin ... 16d4d70d48

endmin, the service account for automated tasks, is a member of the
private studioteal-private org; the CI account is not. It becomes
build.registry's account, so the one credential the daemon pulls with can
read gbb-macos, and gbb-registry-pull holds its package read/write token.

push-macos-image.sh now takes that token as REGISTRY_TOKEN and:
- logs in as the account before the long build, so a bad token fails fast
- with an organization-scoped token, confirms the org is private and the
  account a member before building
- after pushing, requires the anonymous pull to be refused and the
  account's pull to succeed -- the cluster's own pull, run early

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

endmin merged commit cea65c0285 into main 2026-09-27 16:25:36 +00:00

endmin referenced this pull request from a commit 2026-09-27 16:25:36 +00:00

Merge pull request 'fix/macos-private-registry' (#18) from fix/macos-private-registry into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

StudioTeal/GodotBinaryBuilder!18

No description provided.