chore: publish the image to ghcr.io/ai-openshell/console and rename the Go module

.github/workflows/ci.yml

@@ -325,6 +325,9 @@ jobs:
 
   build:
     runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      packages: write
     env:
       PUBLISH_IMAGE: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
     strategy:
@@ -356,13 +359,13 @@ jobs:
       - uses: docker/login-action@v3
         if: env.PUBLISH_IMAGE == 'true'
         with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - uses: docker/metadata-action@v5
         id: meta
         with:
-          images: quay.io/gkrumbach07/openshell-dashboard
+          images: ghcr.io/ai-openshell/console
       - uses: docker/build-push-action@v6
         id: build
         with:
@@ -380,7 +383,7 @@ jobs:
             DASHBOARD_COMMIT=${{ github.sha }}
           cache-from: type=gha,scope=${{ matrix.platform }}
           cache-to: type=gha,scope=${{ matrix.platform }},mode=max
-          outputs: ${{ env.PUBLISH_IMAGE == 'true' && 'type=image,name=quay.io/gkrumbach07/openshell-dashboard,push-by-digest=true,name-canonical=true,push=true' || '' }}
+          outputs: ${{ env.PUBLISH_IMAGE == 'true' && 'type=image,name=ghcr.io/ai-openshell/console,push-by-digest=true,name-canonical=true,push=true' || '' }}
       - name: Export digest
         if: env.PUBLISH_IMAGE == 'true'
         run: |
@@ -410,6 +413,9 @@ jobs:
   push-manifest:
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     needs: [build]
     steps:
       - uses: actions/download-artifact@v4
@@ -420,13 +426,13 @@ jobs:
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
         with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - uses: docker/metadata-action@v5
         id: meta
         with:
-          images: quay.io/gkrumbach07/openshell-dashboard
+          images: ghcr.io/ai-openshell/console
           # sha-<first 7 characters of the commit> is how every later tag finds
           # this image: promote-latest below, and the version tags publish.yml
           # adds when a release is cut. Keep the format in step with both.
@@ -438,7 +444,7 @@ jobs:
         run: |
           docker buildx imagetools create \
             $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf 'quay.io/gkrumbach07/openshell-dashboard@sha256:%s ' *)
+            $(printf 'ghcr.io/ai-openshell/console@sha256:%s ' *)
 
   # Reads the image that push-manifest just pushed back from the registry and
   # checks that its labels declare the gateway release line and the SDK on both
@@ -453,14 +459,24 @@ jobs:
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     needs: [push-manifest]
+    permissions:
+      contents: read
+      packages: read
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: "22"
       - uses: docker/setup-buildx-action@v3
+      # A new GHCR package is private until an org admin makes it public, and
+      # reading a private image needs a login.
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: The pushed image declares its gateway release line
-        run: node scripts/check-image-range.mjs "quay.io/gkrumbach07/openshell-dashboard:sha-${GITHUB_SHA::7}"
+        run: node scripts/check-image-range.mjs "ghcr.io/ai-openshell/console:sha-${GITHUB_SHA::7}"
 
   # `latest` only moves to a commit that passed everything, and only forward.
   #
@@ -488,6 +504,9 @@ jobs:
   promote-latest:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     needs:
       [
         push-manifest,
@@ -513,12 +532,12 @@ jobs:
       - uses: docker/login-action@v3
         if: steps.tip.outputs.is_tip == 'true'
         with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Point latest at this commit's image
         if: steps.tip.outputs.is_tip == 'true'
-        run: scripts/retag-image.sh quay.io/gkrumbach07/openshell-dashboard "sha-${GITHUB_SHA::7}" latest
+        run: scripts/retag-image.sh ghcr.io/ai-openshell/console "sha-${GITHUB_SHA::7}" latest
 
   # Dev charts are deliberately floating. Stable chart versions are published
   # only from publish.yml after the versioned container image has been tagged.

.github/workflows/publish.yml

@@ -212,7 +212,7 @@ jobs:
   # released, sha-<commit> names a new build by now, and retag-image.sh fails
   # here rather than move the release onto it. See docs/releasing.md.
   #
-  # A separate job so that the registry credentials are never in the job that
+  # A separate job so that the package permission is never in the job that
   # holds the repository permissions, and so that a registry hiccup can
   # be retried on its own ("Re-run failed jobs") without touching the release.
   tag-image:
@@ -221,6 +221,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      packages: write
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
@@ -229,17 +230,17 @@ jobs:
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
       - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Tag the image built for this commit with the release version
         env:
           SOURCE_TAG: ${{ needs.publish.outputs.source_tag }}
           IMAGE_TAGS: ${{ needs.publish.outputs.image_tags }}
         run: |
           set -euo pipefail
           read -r -a tags <<< "$IMAGE_TAGS"
-          scripts/retag-image.sh quay.io/gkrumbach07/openshell-dashboard "$SOURCE_TAG" "${tags[@]}"
+          scripts/retag-image.sh ghcr.io/ai-openshell/console "$SOURCE_TAG" "${tags[@]}"
 
   # Packaged from this commit with the image tag that tag-image just published.
   # Never re-push a stable OCI version; an existing version is left unchanged.

README.md

@@ -70,7 +70,7 @@ A dashboard release is for one minor release line of the OpenShell gateway: ever
 
 | Your gateway | Dashboard | Container image |
 |---|---|---|
-| `0.1.x` | `0.1.x` | `quay.io/gkrumbach07/openshell-dashboard:0.1` for the newest release of the line, or an exact `:0.1.N` |
+| `0.1.x` | `0.1.x` | `ghcr.io/ai-openshell/console:0.1` for the newest release of the line, or an exact `:0.1.N`. Releases up to `0.1.3` are at `quay.io/gkrumbach07/openshell-dashboard` |
 | `0.0.116` | the [`gateway-0.0.116`](https://github.com/ai-openshell/console/releases/tag/gateway-0.0.116) release | `quay.io/gkrumbach07/openshell-dashboard:gateway-0.0.116` |
 
 `gateway-0.0.116` is a one-off build for gateway `0.0.116` only. It sits outside the version numbering, and no further release is planned for it.

backend/cmd/server/gateway_setup.go

@@ -8,8 +8,8 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/clients"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/clients"
+	"github.com/ai-openshell/console/backend/pkg/models"
 )
 
 type gatewayClients struct {

backend/cmd/server/gateway_setup_test.go

@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/models"
 )
 
 // captureLogs swaps the default logger for the duration of a test and returns

backend/cmd/server/main.go

@@ -21,9 +21,9 @@ import (
 	"os/signal"
 	"syscall"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/auth"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/server"
+	"github.com/ai-openshell/console/backend/pkg/auth"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/server"
 )
 
 const (

backend/go.mod

@@ -1,4 +1,4 @@
-module github.com/Gkrumbach07/openshell-dashboard/backend
+module github.com/ai-openshell/console/backend
 
 go 1.26.7
 

backend/pkg/clients/auth.go

@@ -3,7 +3,7 @@ package clients
 import (
 	"context"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/auth"
+	"github.com/ai-openshell/console/backend/pkg/auth"
 )
 
 // ContextAuthProvider implements grpc.PerRPCCredentials by reading the JWT

backend/pkg/handlers/allworkspaces_handler.go

@@ -5,9 +5,9 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 // AllWorkspacesHandler serves the lists that span every workspace on the

backend/pkg/handlers/allworkspaces_handler_test.go

@@ -12,8 +12,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
+	"github.com/ai-openshell/console/backend/pkg/services"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )

backend/pkg/handlers/drafts_handler.go

@@ -10,9 +10,9 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 // ApproveDraftChunkRequest optionally carries the chunk's review token, which

backend/pkg/handlers/drafts_handler_test.go

@@ -10,10 +10,10 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 	sdktypes "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/types"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 // draftRoutes mounts the draft routes on the paths app.go gives them.

backend/pkg/handlers/drafts_summary_handler_test.go

@@ -16,9 +16,9 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 // draftSummaryRoutes mounts the two summary routes on the paths app.go gives

backend/pkg/handlers/files_download_handler_test.go

@@ -14,9 +14,9 @@ import (
 	"github.com/go-chi/chi/v5"
 	chimiddleware "github.com/go-chi/chi/v5/middleware"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 // loginShellNoise is what a sandbox under the base policy prints on stderr

backend/pkg/handlers/files_handler.go

@@ -15,9 +15,9 @@ import (
 	"time"
 	"unicode/utf8"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 const defaultUploadDir = "/sandbox"

backend/pkg/handlers/files_handler_test.go

@@ -13,8 +13,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 func TestValidateFilePath(t *testing.T) {

backend/pkg/handlers/files_upload_handler_test.go

@@ -16,9 +16,9 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 func TestValidRelativePath(t *testing.T) {

backend/pkg/handlers/gateway_handler.go

@@ -4,10 +4,10 @@ import (
 	"context"
 	"net/http"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/auth"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/auth"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 type GatewayHandler struct {

backend/pkg/handlers/gateway_handler_test.go

@@ -12,10 +12,10 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/auth"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/auth"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 func TestGetGateway(t *testing.T) {

backend/pkg/handlers/list_pagination.go

@@ -6,7 +6,7 @@ import (
 
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
 )
 
 // listRequestOptions keeps the existing array response unless pageSize was

backend/pkg/handlers/list_pagination_test.go

@@ -11,7 +11,7 @@ import (
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 	"github.com/go-chi/chi/v5"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 func TestPagedListRoutesFetchOneGatewayPage(t *testing.T) {

backend/pkg/handlers/logs_handler.go

@@ -13,9 +13,9 @@ import (
 	openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1"
 	pb "github.com/NVIDIA/OpenShell/sdk/go/proto/openshellv1"
 
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/apiutils"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/models"
-	"github.com/Gkrumbach07/openshell-dashboard/backend/pkg/services"
+	"github.com/ai-openshell/console/backend/pkg/apiutils"
+	"github.com/ai-openshell/console/backend/pkg/models"
+	"github.com/ai-openshell/console/backend/pkg/services"
 )
 
 const logDefaultLines uint32 = 200