From 5b28b3106a605e60c58a3c0ebee93bf361d1d7c3 Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremy@37signals.com>
Date: Wed, 7 Oct 2026 22:55:31 -0700
Subject: [PATCH] Build only into once-campfire-edge; release-images promotes
 releases

This repository's token now writes only the edge package. basecamp/release-images copies an approved edge digest into the release package, so the release environment and the publish token are no longer used here.
---
 .github/workflows/publish-image.yml | 30 ++++++-----------------------
 1 file changed, 6 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index 95f648e..725652a 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -41,8 +41,7 @@ jobs:
             arch: arm64
     env:
       REGISTRY: ghcr.io
-      # Per-arch images always go to <repo>-edge, with this repository's own token;
-      # the release package receives them only through the manifest job below.
+      # Everything goes to <repo>-edge, with this repository's own token.
       IMAGE_NAME: ${{ github.repository }}-edge
     steps:
       - name: Checkout
@@ -89,9 +88,6 @@ jobs:
             type=ref,event=branch
             type=ref,event=tag
             type=sha,format=short,prefix=sha-
-            type=semver,pattern={{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-            type=semver,pattern={{major}}.{{minor}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-            type=semver,pattern={{major}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
           flavor: |
             latest=false
             suffix=-${{ matrix.arch }}
@@ -130,7 +126,8 @@ jobs:
     name: Create multi-arch manifest and sign
     needs: build
     if: github.event_name != 'pull_request'
-    environment: ${{ startsWith(github.ref, 'refs/tags/v') && 'release' || 'edge' }}
+    # Multi-platform tags, signed, in <repo>-edge only. basecamp/release-images
+    # promotes v* tags from there into the release package after a reviewer approves.
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -139,8 +136,7 @@ jobs:
     timeout-minutes: 20
     env:
       REGISTRY: ghcr.io
-      IMAGE_NAME: ${{ startsWith(github.ref, 'refs/tags/v') && github.repository || format('{0}-edge', github.repository) }}
-      EDGE_IMAGE_NAME: ${{ github.repository }}-edge
+      IMAGE_NAME: ${{ github.repository }}-edge
     steps:
       - name: Set up Docker Buildx (for imagetools)
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
@@ -149,12 +145,8 @@ jobs:
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
-          # GHCR_PUBLISH_TOKEN (classic PAT, write:packages, machine user) exists only in
-          # the `release` environment. Once the release package's Actions access is locked
-          # to read, this repository's GITHUB_TOKEN cannot push to it; until then the
-          # fallback keeps releases working.
-          username: ${{ secrets.GHCR_PUBLISH_TOKEN && vars.GHCR_PUBLISH_USER || github.actor }}
-          password: ${{ secrets.GHCR_PUBLISH_TOKEN || secrets.GITHUB_TOKEN }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Compute canonical image name (lowercase)
         id: vars
@@ -174,10 +166,6 @@ jobs:
             type=ref,event=branch
             type=ref,event=tag
             type=sha,format=short,prefix=sha-
-            type=semver,pattern={{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-            type=semver,pattern={{major}}.{{minor}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-            type=semver,pattern={{major}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
           flavor: |
             latest=false
           labels: |
@@ -196,12 +184,6 @@ jobs:
             [ -z "$tag" ] && continue
             echo "Creating manifest for $tag"
             src_tag="$tag"
-            if [[ "$tag" == *:latest && "${GITHUB_REF}" == refs/tags/* ]]; then
-              ref="${GITHUB_REF#refs/tags/}"
-              src_tag="${tag%:latest}:$ref"
-            fi
-            # The per-arch sources always live in the edge package.
-            src_tag="${REGISTRY}/${EDGE_IMAGE_NAME,,}:${src_tag##*:}"
             if [ -n "${IMAGE_DESCRIPTION:-}" ]; then
               docker buildx imagetools create \
                 --tag "$tag" \