ci: publish auth-provider, not auth-auth-provider - #7
Merged
Conversation
The image name was built as auth-${{ matrix.generator }}, and one generator is
already called auth-provider — so the registry carried
ghcr.io/provin-line/auth-auth-provider, a name that says nothing twice. The
doubling was an artifact of assembling the string, not a distinction anyone
intended.
The name is now stated per matrix entry rather than derived. That keeps the
prefix where it does work — auth-policy-verifier, because "whose policy
verifier?" is a real question about a generic-sounding component — and drops it
where the component already says auth.
Breaking for anyone pinning the old name, which is exactly why it happens now:
the packages went public minutes ago and no release has been announced, so the
set of people who could be pinning it is empty. GHCR has no rename and no
alias, so the operation is publish-the-right-name and delete-the-wrong-one;
after this lands, a workflow_dispatch republishes and auth-auth-provider gets
deleted rather than left as a stale duplicate for someone to find later.
CHANGELOG.md's existing entry for the old name is left alone — it records what
was true when it was written.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Jul 26, 2026
Merged
y1o1
added a commit
to provin-line/oss
that referenced
this pull request
Jul 26, 2026
Renamed upstream (provin-line/auth#7): the old auth-auth-provider was an `auth-` prefix concatenated onto a generator already called auth-provider, so the registry carried a name that said nothing twice. Both references move — the compose file that pulls it, and the source-build fallback Dockerfile's comment describing what compose uses. Nothing else in this repository named it. Done before this repository goes public, while the set of people who could be pinning the old name is still empty. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The name said nothing twice
The image name was assembled as
auth-${{ matrix.generator }}, and one generator is already calledauth-provider. So the registry carried:The doubling was an artifact of building the string, not a distinction anyone intended.
The fix
imageis now stated per matrix entry instead of derived:policy-verifierauth-policy-verifierauth-providerauth-providerThat keeps the prefix where it does work — whose policy verifier is a real question about a generic-sounding component — and drops it where the component already says auth. Asymmetric to look at, correct in both cases.
Why now
This breaks anyone pinning the old name, which is precisely the argument for doing it today: the packages became public minutes ago and no release has been announced, so the set of people who could be pinning it is empty. Every day after this, it gets more expensive and eventually not worth doing at all.
What follows this PR
GHCR has no rename and no alias, so the operation is publish-the-right-name, then delete-the-wrong-one:
workflow_dispatchonpublish-imagesrepublishes both images (no new version tag needed — the workflow already supports manual dispatch)auth-providerpackage is created private (this repo still is), so its visibility needs flipping by handprovin.oss's quickstart compose and the publication runbook move to the new nameauth-auth-provideris deleted rather than left as a stale duplicate for someone to find laterAll of it has to complete before the oss flip, because that is when the quickstart becomes the public front door and needs images that exist.
CHANGELOG.md's existing entry naming the old image is left alone — it records what was true when it was written. A newUnreleased / Changedentry documents the break.🤖 Generated with Claude Code