Repository navigation
Setup: Quay.io robot + QUAY_USERNAME / QUAY_TOKEN repo secrets #8
Description
Parent: #5
Why
Upstream publishes the supported catalog-index image to Quay, not GHCR:
| Tier | Upstream destination | Auth |
|---|---|---|
| Plugin images + community catalog-index | ghcr.io/redhat-developer/rhdh-plugin-export-overlays/... |
GITHUB_TOKEN |
| Supported catalog-index | quay.io/rhdh-community/plugin-catalog-index |
QUAY_USERNAME + QUAY_TOKEN |
This fork must not push to quay.io/rhdh-community (that org is Red Hat’s). We need our own Quay namespace, same pattern.
Not required for the workspaces/todo GHCR slice. Community plugins (todo) go to GHCR. Do this when we want supported-catalog parity.
Account to create
- A quay.io user (or log in with GitHub/Red Hat SSO).
- A Quay organization for Parasol, e.g.
rhdh-parasol(create if it does not exist). - A robot account in that org, e.g.
rhdh-parasol+github_actions. - A public repository:
plugin-catalog-index
full ref:quay.io/rhdh-parasol/plugin-catalog-index - Grant the robot write on that repository.
Robot token UI: Quay org → Robot Accounts → github_actions → generate token.
Tokens to write where
GitHub repo → Settings → Secrets and variables → Actions → Repository secrets:
| Secret name | Value | Used by |
|---|---|---|
QUAY_USERNAME |
robot name, e.g. rhdh-parasol+github_actions |
.github/workflows/generate-catalog-index.yaml (publish-supported) |
QUAY_TOKEN |
robot token | same |
Do not put these in GitHub Variables (they are credentials). Do not commit them.
After the secrets exist, a small follow-up PR should:
- set
SUPPORTED_CATALOG_INDEX: quay.io/rhdh-parasol/plugin-catalog-index - re-enable the supported catalog generate/publish jobs (currently skipped on this fork)
Acceptance
- Quay org + robot + public
plugin-catalog-indexrepo exist -
QUAY_USERNAMEandQUAY_TOKENare set onrhdh-parasol/rhdh-plugin-export-overlays - Follow-up PR retargets
SUPPORTED_CATALOG_INDEX(not this issue’s code) - A catalog-index workflow run pushes
quay.io/rhdh-parasol/plugin-catalog-index:<tag>
Activity
fullsend-ai-triage commentedon Sep 1, 2026
🤖 Finished Triage · ✅ Success · Started 12:59 PM UTC · Completed 1:03 PM UTC
Commit:
6d28288· View workflow run →Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $0.64
fullsend-ai-triage commentedon Sep 1, 2026
This is a manual infrastructure task — no code changes are in scope. The work involves creating Quay.io resources and setting GitHub repository secrets, which must be done by a repository admin through the Quay.io and GitHub web UIs.
Verification
Once the Quay org, robot account, and GitHub secrets are in place, verify by triggering the
generate-catalog-index.yamlworkflow'spublish-supportedjob and confirming the image lands atquay.io/rhdh-parasol/plugin-catalog-index:<tag>. The image should be publicly pullable without authentication.Related issues
The follow-up PR to retarget
SUPPORTED_CATALOG_INDEXand re-enable the publish jobs is explicitly out of scope for this issue.Next steps:
/fs-code— agent creates a PR to implement this issue/fs-code <your instruction>— agent implements with your specific guidancedurandom commentedon Sep 3, 2026
#5 is complete without Quay. The fork community catalog-index is on GHCR (
ghcr.io/rhdh-parasol/rhdh-plugin-export-overlays/plugin-catalog-index). The supported/Quay job is skipped untilQUAY_USERNAME/QUAY_TOKENexist. Leaving this open as the later supported-index slice.