From 2d861c6bf0bf8c68b5bca0975476ee72c780f3d3 Mon Sep 17 00:00:00 2001 From: ekklesia Date: Mon, 12 Oct 2026 22:23:52 -0500 Subject: [PATCH] chore: publish and document packages at the registry's current Zayin location The package registry moved with the repositories to git.zayin.net/api/packages/Zayin/npm/; the old River_of_Glory_Church address now answers 502, so the next manual Publish packages run would have failed. Point the workflow, the release and module-development docs, and the disposable-Gitea publication proof's owner at Zayin. The CI Docker label keys keep their names: they are identifiers the sweep matches on, not hosts. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/publish-packages.yml | 2 +- docs/development/releases.md | 12 ++++++------ docs/module-development/README.md | 2 +- scripts/test-package-publication.sh | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/publish-packages.yml b/.github/workflows/publish-packages.yml index 9b2563d..d92bf01 100644 --- a/.github/workflows/publish-packages.yml +++ b/.github/workflows/publish-packages.yml @@ -27,7 +27,7 @@ concurrency: env: # The only registry-specific setting: where the train is published. - EKKLESIA_PACKAGES_REGISTRY: https://git.riverofglorymn.org/api/packages/River_of_Glory_Church/npm/ + EKKLESIA_PACKAGES_REGISTRY: https://git.zayin.net/api/packages/Zayin/npm/ jobs: package-release: diff --git a/docs/development/releases.md b/docs/development/releases.md index 46e4a47..1a96423 100644 --- a/docs/development/releases.md +++ b/docs/development/releases.md @@ -207,10 +207,10 @@ Two builds of the same commit produce byte-identical tarballs, and CI proves it ## Publishing the train -The registry is the Gitea npm registry under the `River_of_Glory_Church` owner: +The registry is the Gitea npm registry under the `Zayin` owner: ```text -https://git.riverofglorymn.org/api/packages/River_of_Glory_Church/npm/ +https://git.zayin.net/api/packages/Zayin/npm/ ``` | Who | May | @@ -272,7 +272,7 @@ Evidence that one train was published, not a second package catalog, and never a { "publicationRecord": 1, "packageTrain": { "version": "0.2.0", "revision": "", "manifestSha256": "" }, - "registry": "https://git.riverofglorymn.org/api/packages/River_of_Glory_Church/npm/", + "registry": "https://git.zayin.net/api/packages/Zayin/npm/", "finalTag": "latest", "completedAt": "", "packages": [ @@ -297,7 +297,7 @@ Evidence that one train was published, not a second package catalog, and never a - **One credential:** `EKKLESIA_PACKAGES_PUBLISH_TOKEN`, a repository Actions secret, used only by the publish step. Nobody needs a token to read or install. -- **The publisher** is a dedicated account, member only of a `River_of_Glory_Church` team whose one +- **The publisher** is a dedicated account, member only of a `Zayin` team whose one permission is Packages: Write. Its token has only the `write:package` scope. Gitea's `write:package` also allows deleting packages; the tool never does, and nothing else uses the token. @@ -319,7 +319,7 @@ guarantee: - **A published version is never deleted,** by anyone, for any reason short of a security incident. - **A version number is never reused with other bytes.** A version found on the registry with other bytes is burned: investigate how it got there, and publish the train under a new version. -- **No package cleanup rule** may be configured for the `River_of_Glory_Church` owner. +- **No package cleanup rule** may be configured for the `Zayin` owner. - **The publisher never deletes.** The tool has no delete, unpublish, or overwrite, and its tests check that. @@ -359,7 +359,7 @@ claim to be source that 0.1.2 never contained. Before it, an administrator of the Gitea instance: 1. creates the dedicated publisher account; -2. creates a `River_of_Glory_Church` team, for example `package-publishers`, with only the Packages +2. creates a `Zayin` team, for example `package-publishers`, with only the Packages unit at Write, and adds the account to it; 3. creates a token for the account with only `write:package`, and stores it as the repository Actions secret `EKKLESIA_PACKAGES_PUBLISH_TOKEN`; diff --git a/docs/module-development/README.md b/docs/module-development/README.md index cc1d80c..e6e39b4 100644 --- a/docs/module-development/README.md +++ b/docs/module-development/README.md @@ -89,7 +89,7 @@ promises no API stability beyond the pre-1.0 SemVer policy. Only Ekklesia's rele the registry in your repository's committed `.npmrc`; that is all the configuration there is: ```ini -@ekklesia:registry=https://git.riverofglorymn.org/api/packages/River_of_Glory_Church/npm/ +@ekklesia:registry=https://git.zayin.net/api/packages/Zayin/npm/ ``` Then the module builds and packages like any other: diff --git a/scripts/test-package-publication.sh b/scripts/test-package-publication.sh index 0a42846..d84c0cc 100755 --- a/scripts/test-package-publication.sh +++ b/scripts/test-package-publication.sh @@ -110,7 +110,7 @@ for user in publisher outsider; do password_variable="${user}_password" api POST /admin/users "{\"username\":\"$user\",\"password\":\"${!password_variable}\",\"email\":\"$user@example.invalid\",\"must_change_password\":false}" >/dev/null done -owners=(River_of_Glory_Church ekklesia-burned-version ekklesia-tag-retry ekklesia-artifact-layout) +owners=(Zayin ekklesia-burned-version ekklesia-tag-retry ekklesia-artifact-layout) for owner in "${owners[@]}"; do api POST /orgs "{\"username\":\"$owner\",\"visibility\":\"public\"}" >/dev/null team="$(api POST "/orgs/$owner/teams" '{"name":"package-publishers","includes_all_repositories":false,"can_create_org_repo":false,"units":["repo.packages"],"units_map":{"repo.packages":"write"}}' |