[Gkrumbach07]

Follows #133, which is merged. Rebased onto main.

Why

Simon (infra) is setting up publishing so that no job writes a package with the workflow's own token, before the packages go public. This PR is the console side of that.

What changes

Releases publish through the release environment

• That environment admits only main and release/**, and holds GHCR_TOKEN, which can write to ghcr.io/ai-openshell/console and its chart.
• Jobs that log in with it:
  • in ci.yml, on a push: build, push-manifest, promote-latest, publish-dev-chart
  • in publish.yml: tag-image, publish-chart
• No job asks for packages: write any more. image-range still reads with the workflow token.

A pull request publishes nothing to console

• build still builds both platforms on a PR, but pushes nothing and writes no build cache: cache-to only runs on a push.
• build uses the environment only on a push (environment: ${{ github.event_name == 'push' && 'release' || '' }}), so a PR run has no environment and can't reach the token, even if it edits the workflow.

PR images go to console-dev, after approval

• A new pr-image job runs in the pr-images environment. That environment's GHCR_TOKEN can write to ghcr.io/ai-openshell/console-dev only.
• It runs only for PRs from a branch of this repo, waits for a maintainer to approve, then pushes console-dev:pr-<n> and :sha-<7> for linux/amd64.
• It runs on plain pull_request, not pull_request_target, as Simon asked, and only reads the cache. Fork PRs get no image, as intended.

Every action in ci.yml is pinned by commit SHA, like publish.yml and follow-upstream.yml.

Tests now enforce all of this: no packages: write anywhere, the exact list of jobs that hold GHCR_TOKEN and their environments, no cache written from a PR, the pr-image rules, and SHA pinning across ci.yml and publish.yml. docs/releasing.md has a new "Who can write the packages" section.

Testing

• python3 -m unittest discover -s deploy/ci/upstream: 277 pass
• node --test "scripts/**/*.test.mjs": 88 pass
• YAML parse of all workflows

Not tested live yet:

• This PR's own CI checks one thing. A PR run uses the empty-environment case (environment: ''), which I'm relying on to mean "no environment". If GitHub treats it differently, it shows up here first.
• The push path can only be checked after merge, once the environments exist.

Needs from infra before merge

Names assumed. Tell me if Simon's differ; each is one place to change:

• Environment release, with deployment branches main and release/**, and secret GHCR_TOKEN.
• Environment pr-images, with required reviewers (maintainers), and secret GHCR_TOKEN (write on console-dev only).
• Optional variable GHCR_USERNAME in each, if the token needs a specific user name. Otherwise the run's actor is used.

After merge (infra)

• The repo's own Actions access to the packages becomes read-only.
• console, the chart and console-dev are made public, after the old pr-* images are deleted from console.

🤖 Generated with Claude Code