docs(packages): document the cross-organization receiver shape - #68
Merged
Conversation
The reusable receiver reads its aggregate signing and R2 credentials from the packages-production environment, and GitHub does not deliver a caller environment secret to a reusable workflow owned by another organization. Every cross-organization adopter therefore failed publication with "GPG_PASSPHRASE is empty" at the last step of onboarding, after the producer release was already public. Document two receiver shapes: the existing reusable call for same-organization central repositories, and a step-for-step local workflow for cross-organization adopters, which keeps the aggregate keys environment-only and acquires the stamped release-cli with checksum and attestation verification. Refs #67; proven by componere/pkgs publishing componere/incusos-builder v0.2.0 (36 artifacts) and client installs on Debian, Fedora, and Alpine.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the documentation half of #67.
GitHub does not deliver a caller's environment secrets to a reusable workflow owned by a different organization, so
publish-package-repository.yml— which reads its aggregate signing and R2 credentials frompackages-production— fails withGPG_PASSPHRASE is emptyfor every cross-organization central repository, at the last step of onboarding, after the producer release is already public.secrets: inheritdoes not help: it reaches repository and organization scopes only.This PR:
operate-a-native-package-repository.mdinto two variants: the existing reusable call (same-organization) and a local workflow (cross-organization) that mirrors the reusable receiver step for step, selectspackages-productionin its own repository so environment secrets resolve natively, and pinssetup-release-cli/setup-package-repositoryto the release-unit SHA;release-system.md's receiver section.Evidence the local shape works:
componere/pkgspublishedcomponere/incusos-builderv0.2.0 through it (state: published, 36/36 artifacts), and all three repositories verified from real clients —apt-geton Debian,dnfwithgpgcheck=1+repo_gpgcheck=1on Fedora,apk addon Alpine. Both v0.1.16 and v0.1.17 reusable receivers were shown to fail identically cross-org (issue #67 has the isolation runs), so this is a platform boundary, not a regression.The feature-sized follow-up —
release-cli init package-repositoryemitting this scaffold like the tap and bucket initializers — stays tracked in #67.Note for review:
local-build: alwaysis unavailable in the local shape (action_repositorymust equalworkflow_repository), so the local receiver downloads the stamped release-cli from this repository's release with checksum and attestation verification, which is called out in the doc.