chore(cascade): repo-agnostic template workflows → stage

[evereq]

Cascades #998 to stage. Makes k8s-build.yml derive its image name from the repo (fixing the 403 that has broken every instance's build since 2026-07-09) and gates lint-and-build to the template. Needed on main because that is the branch the platform force-pushes into the 14 Work repos.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4da51143-ad02-48ad-a23d-c60236dbbeb0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Repository casing breaks GHCR references

The image tags and registry cache references interpolate github.repository_owner and github.event.repository.name without normalization. A generated repository whose owner or name includes uppercase characters produces invalid ghcr.io/... repository references, so the build cannot publish its images or use its registry cache. Lowercase these components once and use the normalized value consistently for tags, cache-from, and cache-to.

Artifacts

Focused GHCR uppercase-reference validation source

• The executed Go source reconstructs the workflow’s two tag and shared cache-reference templates, then validates them with the Docker Distribution reference parser; it demonstrates the exact focused check.

Uppercase GHCR workflow references rejected

• Captured output of the executed original-template run with uppercase owner and repository values; all image and cache references are rejected because the repository name must be lowercase.

Lowercased GHCR workflow references accepted

• Captured output of the executed comparison run after lowercasing the owner and repository values; all equivalent image and cache references are accepted, confirming normalization resolves the failure.

_{Ran code and verified through T-Rex}

[greptile-apps]

Greptile Summary

This change makes template workflows repository-aware, limits the web lint-and-build job to the canonical template repository, derives GHCR image and cache names from the current repository, and skips the documentation image when its Dockerfile is absent.

The GHCR name construction was exercised with uppercase owner and repository values. The generated image and cache references were rejected because container repository names must be lowercase, so affected repositories cannot publish images or use the registry cache until the workflow normalizes those values.

Confidence Score: 3/5

Not safe to merge until T-Rex findings are addressed.

The workflow failure was reproduced using uppercase repository components and affects image publication and registry-cache use for repositories whose names contain uppercase characters.

T-Rex reproduced 2 failing behaviors at runtime in .github/workflows/k8s-build.yml; the change needs fixes before it is safe to merge.

Files Needing Attention: .github/workflows/k8s-build.yml

T-Rex Logs

What T-Rex did

• Validated the posted P1 finding by reviewing the uppercase-reference validation source and confirming the uppercase path rejected the references.
• Validated the lowercase path by confirming the lowercase run accepted all references, based on the comparison record from the validation proof.

_{Ran code and verified through T-Rex}

Comments Outside Diff (1)

1. General comment

   GHCR references preserve uppercase repository components

   • Bug
     • Lines 62-65 interpolate github.repository_owner and github.event.repository.name directly into both pushed image tags and registry-cache refs. For an uppercase owner or repository name, these form invalid GHCR/Docker repository references, preventing builds from pushing and using their cache.
   • Cause
     • The workflow does not normalize the owner and repository-name components to lowercase before composing ghcr.io/... references.
   • Fix
     • Derive a lowercased image namespace/name once (or use a metadata action that performs this normalization) and use that normalized value consistently for tags, cache-from, and cache-to.

   _{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "Merge pull request #998 from ever-works/..." | Re-trigger Greptile}