From 7de21ffcd50ab0fe72f76e83491c54dbac0ccac8 Mon Sep 17 00:00:00 2001
From: SirBlobby <adithcool.5@gmail.com>
Date: Sat, 18 Jul 2026 23:28:02 -0400
Subject: [PATCH] Publish images from Gitea only

---
 .gitea/workflows/docker-publish.yml  |  2 +-
 .github/workflows/docker-publish.yml | 72 ----------------------------
 README.md                            |  8 ++--
 3 files changed, 5 insertions(+), 77 deletions(-)
 delete mode 100644 .github/workflows/docker-publish.yml

diff --git a/.gitea/workflows/docker-publish.yml b/.gitea/workflows/docker-publish.yml
index c5aa51b..06b539b 100644
--- a/.gitea/workflows/docker-publish.yml
+++ b/.gitea/workflows/docker-publish.yml
@@ -57,7 +57,7 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=sha
-            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=latest
 
       - name: Build and push Docker image
         uses: docker/build-push-action@v6
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
deleted file mode 100644
index 02e5b6c..0000000
--- a/.github/workflows/docker-publish.yml
+++ /dev/null
@@ -1,72 +0,0 @@
-name: Build and Publish Docker Image
-
-on:
-  push:
-    branches:
-      - main
-      - dev
-    tags:
-      - "v*"
-  release:
-    types: [published]
-  workflow_dispatch:
-    inputs:
-      platforms:
-        description: "Target platforms to build (comma-separated)"
-        required: false
-        default: "linux/amd64,linux/arm64"
-
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-  DEFAULT_PLATFORMS: "linux/amd64,linux/arm64"
-
-jobs:
-  build-and-push:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to the Container registry
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels)
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=ref,event=branch
-            type=ref,event=tag
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=sha
-            type=raw,value=latest,enable={{is_default_branch}}
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: ${{ github.event.inputs.platforms || env.DEFAULT_PLATFORMS }}
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
diff --git a/README.md b/README.md
index 0af6993..c349c6a 100644
--- a/README.md
+++ b/README.md
@@ -218,19 +218,19 @@ The first account created via the setup wizard is automatically an administrator
 
 ## Continuous Integration
 
-Workflows live in `.gitea/workflows` for Gitea Actions and `.github/workflows` for GitHub Actions.
+Workflows live in `.gitea/workflows` and run on Gitea Actions.
 
 | Workflow | Trigger | Purpose |
 |---|---|---|
 | `ci.yml` | push to `main` or `dev`, pull requests | Type checks and builds the frontend, then checks the backend. |
-| `docker-publish.yml` | push to `main`, `v*` tags, releases | Builds the multi-architecture image and pushes it to the registry. |
+| `docker-publish.yml` | push to `main`, `v*` tags, releases | Builds the image and pushes it to the registry, always updating the `latest` tag. |
 
-The Gitea publish workflow needs two repository secrets, since Gitea's built-in token only grants access to its own registry:
+The publish workflow needs two repository secrets, since Gitea's built-in token only grants access to its own registry:
 
 | Secret | Value |
 |---|---|
 | `REGISTRY_USERNAME` | Your GitHub username. |
-| `REGISTRY_TOKEN` | A GitHub personal access token with the `write:packages` scope. |
+| `REGISTRY_TOKEN` | A classic GitHub personal access token with the `write:packages` and `read:packages` scopes. Fine-grained tokens cannot publish to `ghcr.io`. |
 
 Set the image name with the `IMAGE_NAME` variable at the top of the workflow if you publish somewhere other than `ghcr.io/sirblobby/typstdrive`.