2026-07-06 12:11:33 +02:00
1 changed files with 13 additions and 0 deletions
@@ -110,6 +110,19 @@ curl -sS -X POST -H "Authorization: token $SELF_TOKEN" "$API/orgs/{org}/labels"
 5. Ensure the repo can run agents — the org must hold the runtime secrets (ANTHROPIC_API_KEY, SELF_TOKEN,
   TOKEN_* , OLLAMA_URL, OLLAMA_CLOUD_API_KEY); set any missing via the secrets calls above.
 ## Packages / container registry
 Container images pushed by CI land in the **owner's** package namespace (e.g. `ffaerber/-/packages`)
 and are NOT automatically shown on the repo's Packages page — link once after the first push:
 ```
 curl -sS -X POST -H "Authorization: token $SELF_TOKEN" "$API/packages/{owner}/container/{name}/-/link/{repo}"
 curl -sS -X POST -H "Authorization: token $SELF_TOKEN" "$API/packages/{owner}/container/{name}/-/unlink"
 ```
 Registry auth facts (for wiring CI): the internal Actions token (`GITHUB_TOKEN`) is REJECTED by the
 container registry — a real PAT is required. A **user**-namespace package is writable only by that
 user or a site admin, so CI pushing to `<user>/<image>` needs a PAT minted BY that user with scope
 `write:package` only (stored as a repo/user secret, e.g. `REGISTRY_TOKEN`). Your own token carries
 `write:package`, so you can link/unlink and (if ever needed) push to any namespace.
 ## Admin user management
 - Create: `POST /admin/users`. Edit: `PATCH /admin/users/{username}`. Delete: `DELETE /admin/users/{username}` (**confirm first**).
 - List: `GET /admin/users`.