Private GHCR packages need their visibility flipped

[github-actions]

GitHub publishes every new container package as private, and there is no API to change it —
the org package endpoints are list/get/delete/restore only. Visibility can only be flipped in the
web UI, and the flip is one-way: a public package can never be made private again.

The packages below are private and live in a namespace that is meant to be public. Because oras
pulls anonymously, anyone building locally without ghcr credentials gets a cache miss on these
and rebuilds the artifact from scratch.

package	last updated	linked repo
os/armbian-bsp-cli-k3picoitx-edge	2026-09-13	armbian/os	open
os/kernel-spacemit-k3-edge	2026-09-13	armbian/os	open
os/uboot-k3picoitx-edge	2026-09-13	armbian/os	open

On each package page: Package settings → Danger Zone → Change visibility → Public.

A not linked package was pushed with a PAT rather than GITHUB_TOKEN, so GitHub never
connected it to a repository and it inherits no repository access permissions. Adding
--annotation org.opencontainers.image.source=… to the oras push in the build framework
fixes that separately from visibility.

---

Checked 2026-09-14 07:27 UTC. Updated automatically by .github/workflows/maintenance-private-packages.yml;
this issue closes itself once the list is empty.

[github-actions]

All watched packages are public again — closing.