Stop mirroring self-host Docker releases to the legacy GHCR namespace

[marcelruhf]

Summary

Stop this fork's self-host Docker publish path from mirroring releases to ghcr.io/rhyssullivan/executor-selfhost.

The workflow still derives the owner from GITHUB_REPOSITORY_OWNER and keeps the image name executor-selfhost. On this fork that publishes ghcr.io/marcelruhf/executor-selfhost. Tag scheme is unchanged: vX.Y.Z / X.Y.Z / latest for stable, and the prerelease equivalents plus beta.

Public docs and RELEASING.md are left on the upstream image path. This PR does not edit fork-specific documentation.

Linked issue

None. Fork release-image retarget requested separately from the oauth/CIMD work.

What changed

• .github/workflows/publish-selfhost-docker.yml — drop legacy_tags and the mirror-legacy job that pushed to ghcr.io/rhyssullivan/executor-selfhost via GHCR_LEGACY_TOKEN

No documentation, changelog, npm package, or local/CI image-name changes.

This branch is cut from current marcelruhf/executor main only. It does not reuse or amend feat/oauth-cimd-deployment-capability.

Verification

• Diff against main is the one workflow file above.

• Workflow image line remains image="ghcr.io/${owner}/executor-selfhost"; no legacy_image, legacy_tags, GHCR_LEGACY_TOKEN, or rhyssullivan remain in that workflow.

• No changeset: this is fork release-path only, not a published package behavior change.

• Scoped review of GHCR / executor-selfhost / usefulsoftwareco / rhyssullivan / GHCR_LEGACY references

• bun run format:check

• bun run lint

• bun run typecheck

• bun run test

• e2e — not run; no scenario covers GHCR publish target

Checklist

• Added a changeset (bun run changeset), or this change needs none.
• Added or updated tests for the new behaviour. (n/a — release workflow only)
• No secrets, credentials, or private data in the diff.

After merge: GHCR setup

The first publish from this fork creates ghcr.io/marcelruhf/executor-selfhost. Confirm:

1. Actions has packages: write (the workflow already requests it).
2. The GITHUB_TOKEN used by publish-selfhost-docker.yml can push to GHCR under marcelruhf.
3. After the first push, set the package visibility to public if anonymous pulls should work.
4. GHCR_LEGACY_TOKEN is no longer used by this workflow and can be removed from repo secrets if nothing else needs it.
5. npm package names are unchanged.

  

---

Summary by cubic

Stops this fork's self-host Docker releases from mirroring to ghcr.io/rhyssullivan/executor-selfhost; images now publish only to the fork's owner-derived path. After merge, set the new GHCR package visibility to public if anonymous pulls should work; GHCR_LEGACY_TOKEN can be removed from repo secrets if nothing else uses it.

• Removes the mirror-legacy job and its GHCR_LEGACY_TOKEN usage.
• Keeps the existing tag scheme (vX.Y.Z, X.Y.Z, latest, plus prerelease equivalents and beta).
• Public docs and RELEASING.md stay on the upstream image path; local build tags, compose image names, and the container name are unchanged.

^{Written for commit 3b9ffe5. Summary will update on new commits.}

Summary by CodeRabbit

• Documentation

  • Updated self-hosting instructions to use the current Docker image location.
  • Updated tracing setup examples with the current self-hosted Docker image.
  • Revised release documentation to reflect the current image publishing location.

• Changes

  • Stopped publishing release images to the legacy Docker image location.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: a3b4e185-e5d0-49ed-8034-2e76d941a9ea

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: f41c0f89-7e1d-4615-b350-6a5b0d07217b

📥 Commits

Reviewing files that changed from the base of the PR and between 57994b2 and dc639fb.

📒 Files selected for processing (5)

• .github/workflows/publish-selfhost-docker.yml
• RELEASING.md
• apps/docs/hosted/docker.mdx
• apps/docs/hosted/tracing.mdx
• apps/host-selfhost/README.md

💤 Files with no reviewable changes (1)

• .github/workflows/publish-selfhost-docker.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The self-host Docker workflow no longer mirrors images to the legacy namespace. Release and deployment documentation now references ghcr.io/marcelruhf/executor-selfhost.

Changes

Self-host Docker image namespace

Layer / File(s)	Summary
Canonical image publishing .github/workflows/publish-selfhost-docker.yml	The workflow removes legacy image outputs, legacy tag generation, and the job that mirrored release tags to the legacy namespace.
Documentation image references RELEASING.md, apps/docs/hosted/docker.mdx, apps/docs/hosted/tracing.mdx, apps/host-selfhost/README.md	Release and self-host deployment instructions now use ghcr.io/marcelruhf/executor-selfhost.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: rhyssullivan

Merge Risk: ⚪ Minimal · up to dc639

The release workflow and documentation consistently target the fork’s self-host image, with no unresolved merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: retargeting self-host Docker releases and references to the new ghcr.io/marcelruhf/executor-selfhost image.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-18T11:36:35.709851Z	dc639fb	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cubic-dev-ai]

No issues found across 5 files

_{Re-trigger cubic}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dc639fbb17

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Risk: medium. Approved based on a passing Cursor Bugbot check with no Bugbot findings and Cubic’s “No issues found” review. No reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cubic-dev-ai]

1 issue found across 4 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="RELEASING.md">

<violation number="1">
P3: The workflow publishes to `ghcr.io/${owner}/executor-selfhost`, where `owner` is the lowercased `GITHUB_REPOSITORY_OWNER` (publish-selfhost-docker.yml lines 75-76), so on this fork the image lands at `ghcr.io/marcelruhf/executor-selfhost` — as the PR's rollout notes state. The new doc line hardcodes `ghcr.io/usefulsoftwareco/executor-selfhost` (the upstream owner), which is wrong for anyone releasing from this fork and contradicts the PR's own rollout note. Use the `ghcr.io/<owner>/executor-selfhost` placeholder so the doc stays correct on both upstream and the fork.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

Risk: medium. Dismissing the prior approval because Cubic’s latest review on this head reports 1 unresolved issue, so the required no-findings signal no longer holds. Human review is needed.