From 6284190910cff988f6817845e8bf55cdc2d613fe Mon Sep 17 00:00:00 2001
From: Josh France <12610835+16francej@users.noreply.github.com>
Date: Wed, 29 Jul 2026 15:39:26 -0700
Subject: [PATCH] Publish images under a repo-nested GHCR namespace

The qm-<name> packages belong to the repository this one was exported from,
so the new repository's GITHUB_TOKEN cannot push to them: every build fails
with 403 Forbidden on the blob HEAD.

Relinking those packages and making them public would expose every version
they already hold, all built from the pre-export tree. Publish to a fresh
namespace instead and leave the old packages private and untouched.

ghcr.io/yc-software/qm/<name> nests the six images under the repository name,
so a package created by this workflow is owned by this repository from the
first push. The cosign certificate identity already interpolates
github.repository and needs no change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/release-package.yml | 4 ++--
 test/release-workflows.test.ts        | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release-package.yml b/.github/workflows/release-package.yml
index ff8c1e360..37667b1e0 100644
--- a/.github/workflows/release-package.yml
+++ b/.github/workflows/release-package.yml
@@ -47,12 +47,12 @@ jobs:
           provenance: false
           push: true
           build-args: ${{ matrix.build-args }}
-          tags: ghcr.io/yc-software/qm-${{ matrix.name }}:${{ github.sha }}
+          tags: ghcr.io/yc-software/qm/${{ matrix.name }}:${{ github.sha }}
           cache-from: type=gha,scope=qm-${{ matrix.name }}
           cache-to: type=gha,mode=max,scope=qm-${{ matrix.name }}
       - name: Sign exact image
         run: |
-          image='ghcr.io/yc-software/qm-${{ matrix.name }}@${{ steps.build.outputs.digest }}'
+          image='ghcr.io/yc-software/qm/${{ matrix.name }}@${{ steps.build.outputs.digest }}'
           cosign sign --yes "$image"
           cosign verify "$image" \
             --certificate-identity='https://github.com/${{ github.repository }}/.github/workflows/release-package.yml@refs/heads/main' \
diff --git a/test/release-workflows.test.ts b/test/release-workflows.test.ts
index b33dbfd22..dadc06f65 100644
--- a/test/release-workflows.test.ts
+++ b/test/release-workflows.test.ts
@@ -38,7 +38,7 @@ test("the release signs private images without requiring anonymous registry acce
   assert.match(workflow, /platforms: linux\/amd64\s+provenance: false/);
   assert.match(
     workflow,
-    /image='ghcr\.io\/yc-software\/qm-\$\{\{ matrix\.name \}\}@\$\{\{ steps\.build\.outputs\.digest \}\}'\s+cosign sign --yes "\$image"\s+cosign verify "\$image"/,
+    /image='ghcr\.io\/yc-software\/qm\/\$\{\{ matrix\.name \}\}@\$\{\{ steps\.build\.outputs\.digest \}\}'\s+cosign sign --yes "\$image"\s+cosign verify "\$image"/,
   );
   assert.ok(workflow.indexOf("docker/login-action") < workflow.indexOf("docker/build-push-action"));
   assert.ok(workflow.indexOf("docker/build-push-action") < workflow.indexOf("Sign exact image"));