ci: read the org-scoped ZEGIT_CI_PACKAGE_TOKEN, not a repo-local name

The publish path failed at registry login on every dispatch (runs 18, 20) because it read `secrets.ZEGIT_PACKAGE_TOKEN`, a name that exists nowhere. The package-write token every zegit-zoo image workflow uses is ZEGIT_CI_PACKAGE_TOKEN, held above repository scope, so this repository can read it under that name — no second token, no second copy to rotate.
ci: build without an exporter on validation runs; assert chromium and psql (#11 )
2026-09-08 09:05:43 +02:00 · 2026-09-08 06:23:51 +00:00 · 2026-09-08 08:08:17 +02:00 · 2026-09-08 05:52:37 +00:00
1 changed files with 17 additions and 10 deletions
@@ -90,11 +90,11 @@ jobs:
      - name: Registry login
        if: ${{ steps.meta.outputs.push == 'true' }}
        env:
-          TOKEN: ${{ secrets.ZEGIT_PACKAGE_TOKEN }}
+          TOKEN: ${{ secrets.ZEGIT_CI_PACKAGE_TOKEN }}
        run: |
          set -euo pipefail
          if [ -z "${TOKEN:-}" ]; then
-            echo "::error::ZEGIT_PACKAGE_TOKEN is not set, so this dispatch would build an image and push nothing. Issue a package-write token and store it as this secret."
+            echo "::error::ZEGIT_CI_PACKAGE_TOKEN is not visible to this run. It is the org-scoped package-write token every zegit-zoo image workflow uses (docs: flux-config docs/rotation/forge-secrets.yaml); this repository must be able to read the org secret, and the name must match."
            exit 1
          fi
          mkdir -p "$HOME/.docker"
@@ -106,17 +106,25 @@ jobs:
        run: |
          set -euo pipefail
          REF="${REGISTRY}/${IMAGE_PATH}:${{ steps.meta.outputs.tag }}"
+          # No --output on a validation run: buildctl v0.32 has no "cacheonly"
+          # exporter (run 16, 2026-09-08: 'exporter "cacheonly" could not be
+          # found'), so every push-triggered validation since this workflow
+          # was added had failed — silently, since nothing depended on it. A
+          # build without an exporter still builds every stage on both arches.
          if [ "${{ steps.meta.outputs.push }}" = "true" ]; then
-            out="type=image,name=${REF},push=true"
-          else
-            out="type=cacheonly"
-          fi
            buildctl build --progress=plain \
              --frontend dockerfile.v0 \
              --local context=. \
              --local dockerfile=. \
              --opt platform=linux/amd64,linux/arm64 \
-            --output "$out"
+              --output "type=image,name=${REF},push=true"
+          else
+            buildctl build --progress=plain \
+              --frontend dockerfile.v0 \
+              --local context=. \
+              --local dockerfile=. \
+              --opt platform=linux/amd64,linux/arm64
+          fi

      # The image is a TOOLCHAIN, so "it built" is not the property that matters
      # — "it still contains what the gates shell out to" is. build-image.yml
@@ -142,7 +150,7 @@ jobs:
            echo "FROM ${REF}"
            echo 'RUN set -eu; \'
            echo '    python3 -c "import yaml, sys; print(\"python3+yaml\", sys.version.split()[0])"; \'
-            echo '    for t in gcc node bash make curl tar openssl jq; do \'
+            echo '    for t in gcc node bash make curl tar openssl jq chromium-browser psql; do \'
            echo '      command -v "$t" >/dev/null || { echo "MISSING: $t" >&2; exit 1; }; \'
            echo '      echo "ok: $t"; \'
            echo '    done; \'
@@ -154,8 +162,7 @@ jobs:
            --frontend dockerfile.v0 \
            --local context="$work" \
            --local dockerfile="$work" \
-            --opt platform=linux/amd64,linux/arm64 \
-            --output type=cacheonly
+            --opt platform=linux/amd64,linux/arm64
          echo "✓ toolchain intact on linux/amd64 and linux/arm64"

      - name: Summary
Author	SHA1	Message	Date
agent	b38f4760e7	ci: read the org-scoped ZEGIT_CI_PACKAGE_TOKEN, not a repo-local name The publish path failed at registry login on every dispatch (runs 18, 20) because it read `secrets.ZEGIT_PACKAGE_TOKEN`, a name that exists nowhere. The package-write token every zegit-zoo image workflow uses is ZEGIT_CI_PACKAGE_TOKEN, held above repository scope, so this repository can read it under that name — no second token, no second copy to rotate.	2026-09-08 09:05:43 +02:00
markus	02cd70092e	ci: build without an exporter on validation runs; assert chromium and psql (#11 ) build image (gitea) / build (push) Successful in 7m34s Details	2026-09-08 06:23:51 +00:00
agent	c11e2b19f8	ci: build without an exporter on validation runs; assert chromium and psql buildctl v0.32 has no "cacheonly" exporter, so every push-triggered validation build since this workflow was added failed with 'exporter "cacheonly" could not be found' (run 16, 2026-09-08) — unnoticed, since nothing depended on it. A build with no --output still builds every stage on both architectures. The post-publish toolchain assertion now also requires chromium-browser and psql (12.11.1-ci7).	2026-09-08 08:08:17 +02:00
markus	cada2273bb	Merge pull request 'build: chromium, font-noto and postgresql-client for the browser gates' (#10 ) from claude/build/ci7-browser-psql into master build image / build (push) Skipped Details build image (gitea) / build (push) Failing after 9s Details Reviewed-on: #10	2026-09-08 05:52:37 +00:00