Add secure GHCR container publishing by gonced8 · Pull Request #195 · Taxuspt/garmin_mcp

gonced8 · 2026-07-20T16:18:37Z

What changed

build the existing Dockerfile for linux/amd64 and linux/arm64 on pull requests
publish latest and sha-<short-sha> images to GHCR after pushes to main
add OCI source and revision labels plus GitHub Actions caching

keep pull-request builds in a read-only workflow with no package permission
isolate packages: write in the main-push publishing workflow
pin every referenced Action to a full commit SHA
use the repository-scoped automatic GITHUB_TOKEN; no custom secrets are required

parsed both workflow files as YAML
verified all Action references use full SHAs
verified PR builds cannot publish and have no packages: write permission
verified the publish workflow targets both architectures and only runs on main pushes

gonced8 marked this pull request as ready for review July 20, 2026 16:50

pn mentioned this pull request Jul 29, 2026

feat(auth): securely bootstrap Garmin tokens in containers #229

Open

gonced8 force-pushed the feat/ghcr-publishing branch 3 times, most recently from cd66d87 to b5875ca Compare August 3, 2026 16:35

gonced8 added 2 commits August 3, 2026 17:46

Add strength exercise catalog resolution

1380984

Add secure GHCR container publishing

0dd45ce

gonced8 force-pushed the feat/ghcr-publishing branch from b5875ca to 0dd45ce Compare August 3, 2026 16:47