From 92353e18609cac4315f6aabeb824ef0b6a5129a2 Mon Sep 17 00:00:00 2001 From: Lucas Berger Date: Thu, 11 Jun 2026 18:05:30 -0400 Subject: [PATCH] docs(260611-ozt): document release model in README Publishing/Releases section - Add Publishing / Releases section covering auto-trigger, image tags, REGISTRY_PAT secret naming, branch-protection safety gate, and MILESTONE bump - publish.yml already carries condensed header block (committed in prior task) --- README.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/README.md b/README.md index 43acbe1..7893222 100644 --- a/README.md +++ b/README.md @@ -122,6 +122,22 @@ Store the app password in the database via the `/me` endpoint after first login. See [`docs/deployment.md`](docs/deployment.md) for Unraid/Docker Compose deployment notes including the Pangolin/Newt tunnel configuration. +## Publishing / Releases + +Publishing happens automatically on every push to `main` — i.e. when a PR merges. The `.gitea/workflows/publish.yml` workflow runs and builds + pushes the API image to the Gitea container registry. + +**Image:** `git.bergerhouse.net/luckberg/familysync-api` + +**Tags (two per release):** +- `:latest` — moving pointer for easy pulls +- `:-` — immutable, rollback-traceable (e.g. `v1.1-98acff8`) + +**Required secret:** `REGISTRY_PAT` — a Gitea Actions secret holding a PAT with `write:package` scope. Named `REGISTRY_PAT` (not `GITEA_*`): Gitea reserves the `GITEA_` prefix for secret names, so `GITEA_`-prefixed names cannot be created. `GITEA_TOKEN` / `GITHUB_TOKEN` cannot push packages. + +**Safety gate:** Branch protection on `main`, not a `needs:` dependency in `publish.yml`. The PR test jobs (`fast-checks`, `api`, `harness` in `ci.yml`) run on `pull_request` — they never run in the same workflow invocation as `publish.yml`. Tests gate the PR; `main` is trusted to be green because direct push and force push are blocked and the three required checks (`CI / fast-checks (pull_request)`, `CI / api (pull_request)`, `CI / harness (pull_request)`) must pass before merge. + +**To bump the milestone tag** at a milestone boundary: edit the `MILESTONE` env value at the top of `.gitea/workflows/publish.yml`. + ## License Private — not open source.