[ci] Use OCIR for non-release PRs

Changing the container registry from GHCR to OCIR will help with more flexibe image retention policies and removes the restrictions on the GitHub token when contributors submit PRs from forks. Release PRs remain on GHCR, as before. Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
2026-02-05 08:17:59 +00:00 · 2025-07-21 12:53:13 +03:00
17 changed files with 57 additions and 17 deletions
--- a/.github/workflows/pull-requests.yaml
+++ b/.github/workflows/pull-requests.yaml
@@ -1,5 +1,7 @@
 name: Pull Request

+env:
+  REGISTRY: ${{ secrets.OCIR_REPO }}
 on:
  pull_request:
    types: [opened, synchronize, reopened]
@@ -33,9 +35,9 @@ jobs:
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-          registry: ghcr.io
+          username: ${{ secrets.OCIR_USER}}
+          password: ${{ secrets.OCIR_TOKEN }}
+          registry: iad.ocir.io
        env:
          DOCKER_CONFIG: ${{ runner.temp }}/.docker

--- a/packages/apps/tenant/templates/etcd.yaml
+++ b/packages/apps/tenant/templates/etcd.yaml
@@ -4,6 +4,8 @@ kind: HelmRelease
 metadata:
  name: etcd
  namespace: {{ include "tenant.name" . }}
+  annotations:
+    helm.sh/resource-policy: keep
  labels:
    cozystack.io/ui: "true"
    app.kubernetes.io/instance: {{ .Release.Name }}
@@ -17,6 +19,7 @@ spec:
        kind: HelmRepository
        name: cozystack-extra
        namespace: cozy-public
+      version: "*"
  interval: 1m0s
  timeout: 5m0s
 {{- end }}
--- a/packages/apps/tenant/templates/info.yaml
+++ b/packages/apps/tenant/templates/info.yaml
@@ -6,6 +6,8 @@ kind: HelmRelease
 metadata:
  name: info
  namespace: {{ include "tenant.name" . }}
+  annotations:
+    helm.sh/resource-policy: keep
  labels:
    cozystack.io/ui: "true"
    app.kubernetes.io/instance: {{ .Release.Name }}
@@ -19,6 +21,7 @@ spec:
        kind: HelmRepository
        name: cozystack-extra
        namespace: cozy-public
+      version: "*"
  interval: 1m0s
  timeout: 5m0s
 {{- end }}
--- a/packages/apps/tenant/templates/ingress.yaml
+++ b/packages/apps/tenant/templates/ingress.yaml
@@ -4,6 +4,8 @@ kind: HelmRelease
 metadata:
  name: ingress
  namespace: {{ include "tenant.name" . }}
+  annotations:
+    helm.sh/resource-policy: keep
  labels:
    cozystack.io/ui: "true"
    app.kubernetes.io/instance: {{ .Release.Name }}
--- a/packages/apps/tenant/templates/monitoring.yaml
+++ b/packages/apps/tenant/templates/monitoring.yaml
@@ -4,6 +4,8 @@ kind: HelmRelease
 metadata:
  name: monitoring
  namespace: {{ include "tenant.name" . }}
+  annotations:
+    helm.sh/resource-policy: keep
  labels:
    cozystack.io/ui: "true"
    app.kubernetes.io/instance: {{ .Release.Name }}
@@ -17,6 +19,31 @@ spec:
        kind: HelmRepository
        name: cozystack-extra
        namespace: cozy-public
+      version: "*"
  interval: 1m0s
  timeout: 5m0s
+  values:
+    metricsStorages:
+    - name: shortterm
+      retentionPeriod: "3d"
+      deduplicationInterval: "15s"
+      storage: 10Gi
+      vminsert:
+        resources: {}
+      vmselect:
+        resources: {}
+      vmstorage:
+        resources: {}
+    - name: longterm
+      retentionPeriod: "14d"
+      deduplicationInterval: "5m"
+      storage: 10Gi
+      vminsert:
+        resources: {}
+      vmselect:
+        resources: {}
+      vmstorage:
+        resources: {}
+    oncall:
+      enabled: false
 {{- end }}
--- a/packages/apps/tenant/templates/seaweedfs.yaml
+++ b/packages/apps/tenant/templates/seaweedfs.yaml
@@ -4,6 +4,8 @@ kind: HelmRelease
 metadata:
  name: seaweedfs
  namespace: {{ include "tenant.name" . }}
+  annotations:
+    helm.sh/resource-policy: keep
  labels:
    cozystack.io/ui: "true"
    app.kubernetes.io/instance: {{ .Release.Name }}
@@ -17,6 +19,7 @@ spec:
        kind: HelmRepository
        name: cozystack-extra
        namespace: cozy-public
+      version: "*"
  interval: 1m0s
  timeout: 5m0s
 {{- end }}
--- a/packages/core/installer/values.yaml
+++ b/packages/core/installer/values.yaml
@@ -1,2 +1,2 @@
 cozystack:
-  image: ghcr.io/cozystack/cozystack/installer:v0.34.0-beta.3@sha256:59494a5925be00df765dea6409614dc0541301483fce2ad91112740c6cbda2d5
+  image: ghcr.io/cozystack/cozystack/installer:v0.34.0-beta.2@sha256:92639050dc388167c0a7047edc3288423963ecb36954e5cd1f472841bf380713
--- a/packages/core/testing/values.yaml
+++ b/packages/core/testing/values.yaml
@@ -1,2 +1,2 @@
 e2e:
-  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v0.34.0-beta.3@sha256:c39ac409864554d91851e84f969160de065695068efe67d4a6333cae2c703828
+  image: ghcr.io/cozystack/cozystack/e2e-sandbox:v0.34.0-beta.2@sha256:09078954d19c712d34f10b3ff7df30464fad4f492548b79cf0852aa10c7e1e03
--- a/packages/extra/bootbox/images/matchbox.tag
+++ b/packages/extra/bootbox/images/matchbox.tag
@@ -1 +1 @@
-ghcr.io/cozystack/cozystack/matchbox:v0.34.0-beta.3@sha256:e3ce62785adaccd75a2b724926f1cc2103479790cc8002e3f0266d20a2627d8f
+ghcr.io/cozystack/cozystack/matchbox:v0.34.0-beta.2@sha256:4961ef1471b147fec93af18753c0fb8ce54faac83efe5bc432da5814d9fb675c
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,2 +1,2 @@
 cozystackAPI:
-  image: ghcr.io/cozystack/cozystack/cozystack-api:v0.34.0-beta.3@sha256:5c0236521954c943636d396b24da15bf1a26d13fdfe49c323c328d7dc08dfb89
+  image: ghcr.io/cozystack/cozystack/cozystack-api:v0.34.0-beta.2@sha256:57bfc0c22bda71a830a41a50678a71d9887fd2ab73a2481e7fa7169658303151
--- a/packages/system/cozystack-controller/values.yaml
+++ b/packages/system/cozystack-controller/values.yaml
@@ -1,5 +1,5 @@
 cozystackController:
-  image: ghcr.io/cozystack/cozystack/cozystack-controller:v0.34.0-beta.3@sha256:d4c444296fd9d368493d2ad3ba2446e6f74885fb3b312026c6241d7275acc9c0
+  image: ghcr.io/cozystack/cozystack/cozystack-controller:v0.34.0-beta.2@sha256:7d1a8ebceb596defd49c66a14feb1442890fe44911929a28cdf4a3e775d7c727
  debug: false
  disableTelemetry: false
-  cozystackVersion: "v0.34.0-beta.3"
+  cozystackVersion: "v0.34.0-beta.2"
--- a/packages/system/dashboard/charts/kubeapps/templates/dashboard/configmap.yaml
+++ b/packages/system/dashboard/charts/kubeapps/templates/dashboard/configmap.yaml
@@ -76,7 +76,7 @@ data:
      "kubeappsNamespace": {{ .Release.Namespace | quote }},
      "helmGlobalNamespace": {{ include "kubeapps.helmGlobalPackagingNamespace" . | quote }},
      "carvelGlobalNamespace": {{ .Values.kubeappsapis.pluginConfig.kappController.packages.v1alpha1.globalPackagingNamespace | quote }},
-      "appVersion": "v0.34.0-beta.3",
+      "appVersion": "v0.34.0-beta.2",
      "authProxyEnabled": {{ .Values.authProxy.enabled }},
      "oauthLoginURI": {{ .Values.authProxy.oauthLoginURI | quote }},
      "oauthLogoutURI": {{ .Values.authProxy.oauthLogoutURI | quote }},
--- a/packages/system/dashboard/values.yaml
+++ b/packages/system/dashboard/values.yaml
@@ -19,7 +19,7 @@ kubeapps:
    image:
      registry: ghcr.io/cozystack/cozystack
      repository: dashboard
-      tag: v0.34.0-beta.3
+      tag: v0.34.0-beta.2
      digest: "sha256:ac2b5348d85fe37ad70a4cc159881c4eaded9175a4b586cfa09a52b0fbe5e1e5"
  redis:
    master:
@@ -37,8 +37,8 @@ kubeapps:
    image:
      registry: ghcr.io/cozystack/cozystack
      repository: kubeapps-apis
-      tag: v0.34.0-beta.3
-      digest: "sha256:78faa3aa5cbe3ebd4e315e8dcdb786ecc5f7cad4f87306fb60b022678d672105"
+      tag: v0.34.0-beta.2
+      digest: "sha256:80ba10d6a8dc9d0bb5393ada50134925978cc79783d580050c70726fc96b38c6"
    pluginConfig:
      flux:
        packages:
--- a/packages/system/kamaji/values.yaml
+++ b/packages/system/kamaji/values.yaml
@@ -3,7 +3,7 @@ kamaji:
    deploy: false
  image:
    pullPolicy: IfNotPresent
-    tag: v0.34.0-beta.3@sha256:09465ae8285b4ae43203581e443409cd4e1e119dde62a5c14d63ce064fb840b0
+    tag: v0.34.0-beta.2@sha256:09465ae8285b4ae43203581e443409cd4e1e119dde62a5c14d63ce064fb840b0
    repository: ghcr.io/cozystack/cozystack/kamaji
  resources:
    limits:
--- a/packages/system/kubeovn-webhook/values.yaml
+++ b/packages/system/kubeovn-webhook/values.yaml
@@ -1,3 +1,3 @@
 portSecurity: true
 routes: ""
-image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v0.34.0-beta.3@sha256:b7841916659646823f556b7ce299f6ed55a2d10ca81736c19e721a890efd4694
+image: ghcr.io/cozystack/cozystack/kubeovn-webhook:v0.34.0-beta.2@sha256:e98b958da2ca85771ef9fb215111438b70ce210c1840715da80a96deddd4bfda
--- a/packages/system/kubeovn/values.yaml
+++ b/packages/system/kubeovn/values.yaml
@@ -64,4 +64,4 @@ global:
  images:
    kubeovn:
      repository: kubeovn
-      tag: v1.13.14@sha256:8409b093deada39a210784fd96461f16c1b1d5ae50e8a2285416b36a8ff6e13e
+      tag: v1.13.14@sha256:3e5955030e81e51ce73333c59c63e9530bec832bda982d963323fc76c1550f9d
--- a/scripts/common-envs.mk
+++ b/scripts/common-envs.mk
@@ -1,4 +1,4 @@
-REGISTRY := ghcr.io/cozystack/cozystack
+REGISTRY ?= ghcr.io/cozystack/cozystack
 PUSH := 1
 LOAD := 0
 COZYSTACK_VERSION = $(patsubst v%,%,$(shell git describe --tags))