Publish self-host image to legacy GHCR namespace during transition

[RhysSullivan]

Why

The repository moved from RhysSullivan/executor to UsefulSoftwareCo/executor, but GHCR packages do not redirect after an ownership transfer. Existing self-host deployments that still pull ghcr.io/rhyssullivan/executor-selfhost need a transition window where releases continue to update that legacy image.

How

• Keep the current org image build and push to ghcr.io/usefulsoftwareco/executor-selfhost.
• Capture the build digest from the existing build step.
• When GHCR_LEGACY_TOKEN is configured, log in as rhyssullivan and mirror all release tags to ghcr.io/rhyssullivan/executor-selfhost with docker buildx imagetools create from the org image digest.
• When GHCR_LEGACY_TOKEN is absent, skip the legacy mirror with an explicit skip step so the release job still succeeds.

Setup Required

Rhys needs to create a classic PAT on the rhyssullivan account with write:packages, then add it to this repository as the GHCR_LEGACY_TOKEN secret.

Caveat

The legacy PAT identity needs to read the org image digest before it can create the legacy tags. If the org GHCR package is private on first publish, the mirror step may need package visibility or access adjusted. If the org package is public, the current flow should be fine.

Removal

Remove the legacy mirror after a few releases, or once self-host install docs and known downstream deployments have moved to ghcr.io/usefulsoftwareco/executor-selfhost.

Verification

• bun run format:check
• go run github.com/rhysd/actionlint/cmd/actionlint@latest -ignore 'label "blacksmith-4vcpu-ubuntu-2404" is unknown' .github/workflows/publish-selfhost-docker.yml
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/publish-selfhost-docker.yml"); puts "YAML parses"'

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	6686db8	Commit Preview URL Branch Preview URL	Jul 03 2026, 08:42 PM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	6686db8	Jul 03 2026, 08:43 PM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1288

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1288

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1288

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1288

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1288

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1288

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1288

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1288

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1288

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1288

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1288

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1288

executor

npm i https://pkg.pr.new/executor@1288

commit: 6686db8