Publish releases within the organization only

.github/workflows/build.yaml

@@ -144,16 +144,11 @@ jobs:
             test/package-lock.json
       - run: SKIP_SUBMODULE_DEPS=1 npm ci
       - run: npm run test:unit
-      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
-        if: success()
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
 
   build:
     name: linux-x64
     runs-on: ubuntu-22.04
     env:
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
       DISABLE_V8_COMPILE_CACHE: 1
       VERSION: 0.0.0
       VSCODE_TARGET: linux-x64

.github/workflows/publish.yaml

@@ -20,85 +20,15 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  npm:
-    runs-on: ubuntu-latest
-    env:
-      TAG: ${{ inputs.version || github.ref_name }}
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-      NPM_ENVIRONMENT: "production"
-
-    steps:
-      - name: Set version to tag without leading v
-        run: |
-          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
-
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
-        with:
-          node-version-file: .node-version
-
-      - uses: robinraju/release-downloader@28fc21f50d76778e7023361aa1f863e717d3d56f # v1.13
-        with:
-          repository: "coder/code-server"
-          tag: ${{ env.TAG }}
-          fileName: "package.tar.gz"
-          out-file-path: "release-npm-package"
-
-      - run: tar -xzf release-npm-package/package.tar.gz
-      - run: |
-          echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
-          pushd release
-          npm publish --tag latest --access public
-
-  aur:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    env:
-      GH_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
-      TAG: ${{ inputs.version || github.ref_name }}
-
-    steps:
-      - name: Set version to tag without leading v
-        run: |
-          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
-
-      - name: Checkout code-server-aur repo
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-        with:
-          repository: "cdrci/code-server-aur"
-          token: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
-          ref: "master"
-
-      - name: Configure git
-        run: |
-          git config --global user.name cdrci
-          git config --global user.email opensource@coder.com
-
-      - name: Fetch and reset master
-        run: |
-          git remote add upstream https://github.com/coder/code-server-aur.git
-          git fetch upstream
-          git reset --hard upstream/master
-          git push --force
-
-      - name: Validate package
-        uses: heyhusen/archlinux-package-action@3f7aaada28c782497bfe02d6d6ea365b25fdea12 # v3.0.1
-        with:
-          pkgver: ${{ env.VERSION }}
-          updpkgsums: true
-          srcinfo: true
-
-      - name: Open PR
-        run: |
-          git checkout -b update-version-${{ env.VERSION }}
-          git add .
-          git commit -m "Update to ${{ env.VERSION }}"
-          git push -u origin $(git branch --show)
-          gh pr create --repo coder/code-server-aur --title "Update to ${{ env.VERSION }}" --body "PR opened by @$GITHUB_ACTOR" --assignee $GITHUB_ACTOR
-
+  # Publishes the container image to this repository's GitHub Container
+  # Registry namespace. This is the only artifact other MotusLabs projects
+  # consume besides the release assets themselves; nothing is pushed outside
+  # the organization.
   docker:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # To download the release assets.
+      packages: write # To push the image to ghcr.io.
     env:
       GITHUB_TOKEN: ${{ github.token }}
       TAG: ${{ inputs.version || github.ref_name }}
@@ -108,29 +38,33 @@ jobs:
         run: |
           echo "VERSION=${TAG#v}" >> $GITHUB_ENV
 
+      # ghcr.io only accepts lowercase names, while the repository this runs
+      # in may be spelled with capitals.
+      - name: Set image name from this repository
+        run: |
+          echo "GITHUB_REGISTRY=ghcr.io/$(echo "$GITHUB_REPOSITORY" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
       - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      # The packages come from this repository's own release, so the image is
+      # built from the fork's build and not from upstream's.
       - uses: robinraju/release-downloader@28fc21f50d76778e7023361aa1f863e717d3d56f # v1.13
         with:
-          repository: "coder/code-server"
+          repository: ${{ github.repository }}
           tag: v${{ env.VERSION }}
           fileName: "*.deb"
           out-file-path: "release-packages"
       - uses: robinraju/release-downloader@28fc21f50d76778e7023361aa1f863e717d3d56f # v1.13
         with:
-          repository: "coder/code-server"
+          repository: ${{ github.repository }}
           tag: v${{ env.VERSION }}
           fileName: "*.rpm"
           out-file-path: "release-packages"
@@ -139,8 +73,11 @@ jobs:
 
   repo:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # To push the branch.
+      pull-requests: write # To open the PR.
     env:
-      GH_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
+      GH_TOKEN: ${{ github.token }}
       TAG: ${{ inputs.version || github.ref_name }}
     needs: docker
 
@@ -155,13 +92,13 @@ jobs:
 
       - name: Open PR
         run: |
-          git config --global user.name cdrci
-          git config --global user.email opensource@coder.com
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git checkout -b "helm/$VERSION"
           git add .
           git commit -m "Update Helm chart and changelog with $VERSION"
           git push -u origin "$(git branch --show)"
           gh pr create \
-            --repo coder/code-server \
+            --repo "$GITHUB_REPOSITORY" \
             --body-file .cache/checklist \
             --title "Update Helm chart and changelog with $VERSION"

.github/workflows/release.yaml

@@ -14,7 +14,6 @@ on:
 
 permissions:
   contents: write # For creating releases.
-  discussions: write #  For creating a discussion.
 
 # Cancel in-progress runs for pull requests when developers push
 # additional changes
@@ -114,7 +113,6 @@ jobs:
         if: ${{ matrix.vscode_arch == 'x64' }}
         with:
           draft: true
-          discussion_category_name: "📣 Announcements"
           files: package.tar.gz
           tag_name: v${{ env.VERSION }}
           name: v${{ env.VERSION }}
@@ -126,7 +124,6 @@ jobs:
       - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           draft: true
-          discussion_category_name: "📣 Announcements"
           files: ./release-packages/*
           tag_name: v${{ env.VERSION }}
           name: v${{ env.VERSION }}
@@ -192,7 +189,6 @@ jobs:
       - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           draft: true
-          discussion_category_name: "📣 Announcements"
           files: ./release-packages/*
           tag_name: v${{ env.VERSION }}
           name: v${{ env.VERSION }}
@@ -341,7 +337,6 @@ jobs:
       - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           draft: true
-          discussion_category_name: "📣 Announcements"
           files: ./release-packages/*
           tag_name: v${{ env.VERSION }}
           name: v${{ env.VERSION }}

.github/workflows/trivy-docker.yaml

@@ -51,7 +51,7 @@ jobs:
       - name: Run Trivy vulnerability scanner in image mode
         uses: aquasecurity/trivy-action@d2a0b60797ff03db6132bd4e2b293f9b37081297 # latest
         with:
-          image-ref: "docker.io/codercom/code-server:latest"
+          image-ref: "ghcr.io/motuslabs/code-server:latest"
           ignore-unfixed: true
           format: "sarif"
           output: "trivy-image-results.sarif"

.github/workflows/update.yaml

@@ -9,12 +9,19 @@ on:
   schedule:
     - cron: "0 16,21 * * *"
 
+permissions:
+  contents: write # To push the update branch.
+  pull-requests: write # To open the update PR.
+
 jobs:
   update:
     runs-on: ubuntu-latest
     env:
       TAG: ${{ inputs.version }}
-      GH_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
+      # A branch pushed with the built-in token does not start other
+      # workflows, so the update PR gets no CI. Set UPDATE_PR_TOKEN to an
+      # organization PAT to get it; without one this still opens the PR.
+      GH_TOKEN: ${{ secrets.UPDATE_PR_TOKEN || github.token }}
 
     steps:
       - name: Fetch latest tag
@@ -59,14 +66,14 @@ jobs:
       - name: Open PR
         if: steps.check.outputs.done == 'false'
         run: |
-          git config --global user.name cdrci
-          git config --global user.email opensource@coder.com
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git checkout -b "update/$VERSION"
           git add .
           git commit -m "Update Code to $VERSION"
           git push -u origin "$(git branch --show)"
           gh pr create \
-            --repo coder/code-server \
+            --repo "$GITHUB_REPOSITORY" \
             --title "Update Code to $VERSION" \
             --body-file .cache/checklist \
             --draft

CHANGELOG.md

@@ -22,6 +22,15 @@ Code v99.99.999
 
 ## Unreleased
 
+### Changed
+
+- Releases are published inside the organization only. The container image now
+  goes to `ghcr.io/motuslabs/code-server` instead of Docker Hub and
+  `ghcr.io/coder/code-server`, and the npm and AUR publishing steps are gone.
+  `install.sh`, the Docker build and the Helm chart all read from this
+  repository's releases, so they install this fork's build rather than
+  upstream's.
+
 ### Fixed
 
 - Copying from the terminal with OSC 52 (used by tmux, vim, Claude Code and

ci/build/build-vscode.sh

@@ -78,14 +78,14 @@ main() {
     "applicationName": "code-server",
     "dataFolderName": ".code-server",
     "win32MutexName": "codeserver",
-    "licenseUrl": "https://github.com/coder/code-server/blob/main/LICENSE",
+    "licenseUrl": "https://github.com/MotusLabs/code-server/blob/main/LICENSE",
     "win32DirName": "code-server",
     "win32NameVersion": "code-server",
     "win32AppUserModelId": "coder.code-server",
     "win32ShellNameShort": "c&ode-server",
     "darwinBundleIdentifier": "com.coder.code.server",
     "linuxIconName": "com.coder.code.server",
-    "reportIssueUrl": "https://github.com/coder/code-server/issues/new",
+    "reportIssueUrl": "https://github.com/MotusLabs/code-server/issues/new",
     "documentationUrl": "https://go.microsoft.com/fwlink/?LinkID=533484#vscode",
     "keyboardShortcutsUrlMac": "https://go.microsoft.com/fwlink/?linkid=832143",
     "keyboardShortcutsUrlLinux": "https://go.microsoft.com/fwlink/?linkid=832144",

ci/build/nfpm.yaml

@@ -7,8 +7,8 @@ priority: "optional"
 maintainer: "Joe Previte <joe@coder.com>"
 description: |
   Run VS Code in the browser.
-vendor: "Coder"
-homepage: "https://github.com/coder/code-server"
+vendor: "MotusLabs"
+homepage: "https://github.com/MotusLabs/code-server"
 license: "MIT"
 
 contents:

ci/build/update-repo.sh

@@ -67,7 +67,7 @@ function update_helm() {
 function update_changelog() {
   local date
   date=$(printf '%(%Y-%m-%d)T\n' -1)
-  local link="https://github.com/coder/code-server/releases/tag/v$version"
+  local link="${GITHUB_SERVER_URL:-https://github.com}/${GITHUB_REPOSITORY:-MotusLabs/code-server}/releases/tag/v$version"
   sed -i.bak "s|## Unreleased|## Unreleased\n\n## [$version]($link) - $date|" CHANGELOG.md
 }
 
@@ -88,9 +88,6 @@ function main() {
 
   # Even if a step failed, still output the last checkmark.
   run-steps "${steps[@]}" || true
-
-  # This step is always manual.
-  echo "- [ ] https://github.com/coder/code-server-aur/pulls" >> .cache/checklist
 }
 
 main "$@"

ci/helm-chart/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: code-server
-description: A Helm chart for coder/code-server
+description: A Helm chart for MotusLabs/code-server
 
 # A chart can be either an 'application' or a 'library' chart.
 #

ci/helm-chart/values.yaml

@@ -5,7 +5,7 @@
 replicaCount: 1
 
 image:
-  repository: codercom/code-server
+  repository: ghcr.io/motuslabs/code-server
   tag: '4.137.0'
   pullPolicy: Always
 

ci/release-image/docker-bake.hcl

@@ -6,12 +6,17 @@ variable "VERSION" {
     default = "latest"
 }
 
+# Publishing happens inside the organization only. Docker Hub is disabled by
+# leaving this empty; gen_tags then generates no tags for it. Set it only if
+# the organization ever runs its own registry.
 variable "DOCKER_REGISTRY" {
-    default = "docker.io/codercom/code-server"
+    default = ""
 }
 
+# Overridden by the publish workflow with the ghcr.io namespace of whichever
+# repository is running it.
 variable "GITHUB_REGISTRY" {
-    default = "ghcr.io/coder/code-server"
+    default = "ghcr.io/motuslabs/code-server"
 }
 
 group "default" {