[JacobStephens2]

Summary

 server-deploy build
-  push ghcr.io/<owner>/drome-server:<sha>
+  push ghcr.io/<owner>/drome/drome-server:<sha>
+    label org.opencontainers.image.source=https://github.com/<repository>

The build job on main compiles, then GHCR rejects the push. Run 39736182790, at e64e652, logged in and uploaded the layers, then failed with denied: permission_denied: read_package on ghcr.io/jacobstephens2/drome-server:<sha>. That name is already a private package, and this repo's GITHUB_TOKEN cannot read it or delete it.

The workflow now pushes ghcr.io/<owner>/drome/drome-server, tagged with the git SHA, and sets org.opencontainers.image.source so GHCR links the package to this repo. Probe run 39742288182 pushed that nested name with provenance left on, then deleted the probe package. The tag is still the git SHA, never :latest. packages: write stays. The probe workflow is not in this tree.

Seam: the image .github/workflows/server-deploy.yml pushes to GHCR, checked by tests/deploy/ghcr_image_test.sh.

Evidence

• Before: server-deploy run https://github.com/JacobStephens2/drome/actions/runs/39736182790 failed in the build job. The log ends with failed to push ghcr.io/jacobstephens2/drome-server:e64e652e4b43f3d6a75fceb72a679c3f33a7e6f7: denied: permission_denied: read_package. fmt, clippy, and cargo test in that run were green. The deploy job was skipped.
  After: On da9f554, deploy-ci https://github.com/JacobStephens2/drome/actions/runs/39747530735 and server-ci https://github.com/JacobStephens2/drome/actions/runs/39747530808 both passed. Both run tests/deploy/ghcr_image_test.sh. Probe run https://github.com/JacobStephens2/drome/actions/runs/39742288182 pushed ghcr.io/jacobstephens2/drome/drome-server:ci-probe. server-deploy itself does not run until this is on main.

Android build is red on this head (https://github.com/JacobStephens2/drome/actions/runs/39747530788). android-ci.yml starts that job on any pull request that touches server/**. This branch does not change android/ or those tests. Issue #5 names the server-deploy build job, not the Android job.

Merge Danger

Door: one-way for the old package name

Merging creates ghcr.io/jacobstephens2/drome/drome-server on the next push to main that runs server-deploy, and links it here. Pointing the workflow back at ghcr.io/jacobstephens2/drome-server does not make that push work. The new name is reversible until something else pins it: the probe run published it and then deleted that package. Nothing deploys on this merge. DEPLOY_ENABLED is not set, and the deploy job stays skipped. The linked package on this public repo is public. The source is already public. The old private drome-server package stays where it is. This token cannot remove it.

Blast Radius: the next main image build

deploy/deploy.sh already accepts a slash in the image ref. Compose still takes ${IMAGE_TAG} from the environment. No Rust behaviour changes.

Unaddressed findings

Standards

Duplicated Code (judgement call). The OCI source label is spelled two ways: org.opencontainers.image.source=https://github.com/${{ github.repository }} on the labels: input in .github/workflows/server-deploy.yml (line 107), and LABEL org.opencontainers.image.source=https://github.com/JacobStephens2/drome in server/Dockerfile (line 36). The finding says they agree only while github.repository is JacobStephens2/drome, and that tests/deploy/ghcr_image_test.sh fails the build on any other repository name. It did not include a command that fails on this repo.

Declined. They name the same repository. planning/decisions.md records the repo as github.com/JacobStephens2/drome, and on this repo ${{ github.repository }} is JacobStephens2/drome. The workflow label is what docker/build-push-action stamps on the image it pushes, and that value has to stay an Actions expression. The Dockerfile cannot expand that expression, so the two sites cannot share one string. This is not a behaviour failure on this repo.

Duplicated Code (judgement call). The image name is echoed once per job, at .github/workflows/server-deploy.yml lines 91 and 123, and tests/deploy/ghcr_image_test.sh requires that count to stay 2. The finding says extracting one definition would fail that test.

Declined. The split is the pre-existing rule in .github/workflows/server-deploy.yml lines 47-48: IMAGE is computed per job because GHCR requires a lowercase owner and Actions expressions have no lower(). One shared expression cannot replace both lines. The test locks the two copies so they cannot drift. This is not a behaviour failure.

Spec

No findings.

Security

No findings.

Security review outcome

No unaddressed introduced findings.

CI notes

Android build fails on DromeScreensDarkSnapshotTest.onboarding and DromeScreensLightSnapshotTest.onboarding (java.lang.AssertionError at ImageUtils.kt:124, run 39747530788 job 119719623627). That failure is already on main's Android tree: pull request #4 changes only server/src/auth.rs and server/tests/server_test.rs and fails the same two tests (run 39747547343 job 119719680654). This branch does not change android/ or .github/workflows/android-ci.yml. The job runs here because that workflow path-filters server/** and this branch edits server/Dockerfile.

Review coverage

Standards and Spec both read every file in git diff --name-only main...HEAD:

• .github/workflows/deploy-ci.yml
• .github/workflows/server-ci.yml
• .github/workflows/server-deploy.yml
• deploy/compose.yml
• deploy/deploy.sh
• server/Dockerfile
• tests/deploy/ghcr_image_test.sh

No changed file was left unread. No generated output was excluded.

Closes #5

Built with grok · grok-4.7 · xhigh