Decision
Consolidate image publishing to ko.yml → GHCR only. Retire the Docker Hub build (image.yml + Containerfile) and the Wolfi build (apko.yml + melange.yaml + apko.yaml).
Why
|
image.yml (Containerfile/Docker Hub) |
ko.yml (Ko/GHCR) |
apko.yml (Wolfi/melange, GHCR) |
| Registry |
Docker Hub (docker.io/nkanyezisolutions/...) |
GHCR (ghcr.io/blanketops/environments-controller) |
GHCR — same path as ko.yml |
| Multi-arch |
amd64 + arm64 |
amd64 + arm64 |
x86_64 only |
| Toolchain |
docker buildx + hand-written Containerfile |
ko build, no Dockerfile |
melange (bwrap sandbox) + apko publish |
| Auth |
GH_PAT via BuildKit secret |
GH_PAT via git config |
GH_PAT via triple sed-patched .netrc — most fragile |
| Known issue |
Was originally intended as an HA/secondary registry path; no confirmed consumer today |
— |
Races apko.yml/image.yml... actually races ko.yml for the identical GHCR tag on every tag push — whichever finishes last silently overwrites :latest |
Concretely: ko.yml and apko.yml both publish to ghcr.io/blanketops/environments-controller:{version} and :latest on the same push: tags: v* trigger. They race. One image is always thrown away. apko.yml's "hardened Wolfi base" value proposition was also never fully realized — it's single-arch only.
Docker Hub (image.yml) was originally stood up for HA/secondary-registry purposes but has no confirmed downstream consumer.
Plan
Rollback
If Docker Hub or Wolfi turns out to be needed later, git checkout archive/wolfi-and-dockerhub-build -- apko.yml melange.yaml apko.yaml Containerfile .github/workflows/apko.yml .github/workflows/image.yml restores everything.
Decision
Consolidate image publishing to
ko.yml→ GHCR only. Retire the Docker Hub build (image.yml+Containerfile) and the Wolfi build (apko.yml+melange.yaml+apko.yaml).Why
image.yml(Containerfile/Docker Hub)ko.yml(Ko/GHCR)apko.yml(Wolfi/melange, GHCR)docker.io/nkanyezisolutions/...)ghcr.io/blanketops/environments-controller)docker buildx+ hand-writtenContainerfileko build, no Dockerfilemelange(bwrap sandbox) +apko publishsed-patched.netrc— most fragileapko.yml/image.yml... actually racesko.ymlfor the identical GHCR tag on every tag push — whichever finishes last silently overwrites:latestConcretely:
ko.ymlandapko.ymlboth publish toghcr.io/blanketops/environments-controller:{version}and:lateston the samepush: tags: v*trigger. They race. One image is always thrown away.apko.yml's "hardened Wolfi base" value proposition was also never fully realized — it's single-arch only.Docker Hub (
image.yml) was originally stood up for HA/secondary-registry purposes but has no confirmed downstream consumer.Plan
archive/wolfi-and-dockerhub-buildcreated atdevelop@f79fa8d— full pre-removal state recoverable there.github/workflows/apko.yml.github/workflows/image.ymlContainerfilemelange.yamlapko.yamlko.ymlheader comment ("When to use vs apko.yml")vulnscan.yml'strivy-imagejob still targets the correct (now sole) image atghcr.io/blanketops/environments-controllerRollback
If Docker Hub or Wolfi turns out to be needed later,
git checkout archive/wolfi-and-dockerhub-build -- apko.yml melange.yaml apko.yaml Containerfile .github/workflows/apko.yml .github/workflows/image.ymlrestores everything.