[mudler-agent]

Decision

All add-ons publish to one OCI repository, quay.io/go-skynet/local-ai-addons (the value of ADDON_OCI_REPOSITORY). Each add-on is a set of tags in it, prefixed with its id: <id>-sha-<short sha> for a commit, <id>-<version> for a release, <id>-development and <id>-latest for the channel aliases. Example: oci://quay.io/go-skynet/local-ai-addons:fine-tuning-sha-99d1dca2c869.

Before this change, Tables published to the variable and every other add-on to <namespace>/<id>, which did not match the index.

What changed

• .github/workflows/addons-package.yml: the per-add-on repository step is removed from publish and promote. Both jobs read the variable as it is. The fail-closed check stays and also checks that the value has a namespace and a name. Publish prints the target first. Promote passes --addon. The header comment describes the single repository.
• pkg/addons/packaging/registry.go, catalog.go, run.go: the immutable tag, the alias tags and the catalog artifact get the <id>- prefix. New addonpkg target command prints the reference of one add-on without a network request. The tag validation still checks the unprefixed tag.
• pkg/addons/packaging/policy.go: the workflow policy now refuses a derived repository and requires the variable.
• gallery/addons/index.yaml: the artifact field of the seven entries is in the tag form. No digest changed. There is no way to regenerate the index here (the generator, addonpkg catalog, needs the merged layouts of a real publish), so the field was edited by hand.
• Host parser: no change needed. It parses the reference with name.ParseReference, so it accepts oci://<repo>:<tag> and a repository with a nested path. The old per-repository form is still accepted.
• Docs: docs/content/features/addons.md, gallery/addons/README.md.
• Tests: pkg/addons/packaging/packaging_test.go, core/services/addons/packages/install_test.go.

Publish targets (local run of addonpkg target, tag sha-99d1dca2c869)

tables        quay.io/go-skynet/local-ai-addons:tables-sha-99d1dca2c869
voice         quay.io/go-skynet/local-ai-addons:voice-sha-99d1dca2c869
face          quay.io/go-skynet/local-ai-addons:face-sha-99d1dca2c869
fine-tuning   quay.io/go-skynet/local-ai-addons:fine-tuning-sha-99d1dca2c869
quantization  quay.io/go-skynet/local-ai-addons:quantization-sha-99d1dca2c869
studio        quay.io/go-skynet/local-ai-addons:studio-sha-99d1dca2c869
talk          quay.io/go-skynet/local-ai-addons:talk-sha-99d1dca2c869

Tests

• go test ./pkg/addons/packaging: 134 of 134 specs pass. They cover the push and retry against a local registry, the promotion of aliases under the prefix, the catalog artifact of all seven add-ons, the target output for all seven add-ons, and the workflow policy (including mutations that bring back a derived repository).
• go test ./core/services/addons/packages: 25 of 25 pass. Two new specs install from the shared-repository tag form and from the old per-repository form.
• go test ./core/services/addons/catalog: 71 of 71 pass.
• addonpkg policy accepts the workflow.

Not run

• The real publish, signing and any registry access.
• scripts/addons/package_test.sh (needs the UI build dependencies) and tests/addons/packaging (needs the generated gRPC stubs).
• The digests: they are the old ones. Until the add-ons are published again, the new tags in the index do not exist in the registry, so installs from this index fail.

Follow-up

Publish every add-on again from master, then update the digests (and the versions) in gallery/addons/index.yaml from the workflow output.