fix(ci): stabilize fork publishing and desktop smoke fixtures

.github/workflows/docker.yml

@@ -1,6 +1,7 @@
 name: Docker image
 
-# Builds and publishes the public Buzz relay images as ghcr.io/block/buzz.
+# Builds and publishes the public Buzz relay images as ghcr.io/<owner>/<repo>
+# (ghcr.io/block/buzz upstream) plus the matching -push-gateway image.
 # Normal tags contain stripped binaries; matching debug-* tags contain the same
 # optimized binaries with line-table debug information for native profilers.
 #
@@ -77,10 +78,11 @@ concurrency:
 permissions: {}
 
 env:
-  # Single source of truth for the image name. Set GHCR_IMAGE as a repo
-  # variable to override (e.g., for forks that want to push to their own
-  # namespace without forking this file).
-  IMAGE_NAME: ${{ vars.GHCR_IMAGE != '' && vars.GHCR_IMAGE || 'ghcr.io/block/buzz' }}
+  # Single source of truth for the image names. Both default to the running
+  # repository's namespace, so forks publish (and cache) in their own registry.
+  # Set GHCR_IMAGE / GHCR_PUSH_GATEWAY_IMAGE as repo variables to override.
+  IMAGE_NAME: ${{ vars.GHCR_IMAGE != '' && vars.GHCR_IMAGE || format('ghcr.io/{0}', github.repository) }}
+  PUSH_GATEWAY_IMAGE: ${{ vars.GHCR_PUSH_GATEWAY_IMAGE != '' && vars.GHCR_PUSH_GATEWAY_IMAGE || format('ghcr.io/{0}-push-gateway', github.repository) }}
 
 jobs:
   build:
@@ -104,6 +106,11 @@ jobs:
             arch: arm64
 
     steps:
+      - name: Normalize image names
+        shell: bash
+        run: |
+          printf 'IMAGE_NAME=%s\nPUSH_GATEWAY_IMAGE=%s\n' "${IMAGE_NAME,,}" "${PUSH_GATEWAY_IMAGE,,}" >> "$GITHUB_ENV"
+
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
@@ -330,6 +337,11 @@ jobs:
             tag_prefix: debug-
 
     steps:
+      - name: Normalize image names
+        shell: bash
+        run: |
+          printf 'IMAGE_NAME=%s\nPUSH_GATEWAY_IMAGE=%s\n' "${IMAGE_NAME,,}" "${PUSH_GATEWAY_IMAGE,,}" >> "$GITHUB_ENV"
+
       - name: Checkout source
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
@@ -414,7 +426,7 @@ jobs:
 
       - name: Attest provenance for the merged image
         # Sigstore-signed in-toto attestation, verifiable with:
-        #   gh attestation verify oci://ghcr.io/block/buzz:<tag> --owner block
+        #   gh attestation verify oci://<IMAGE_NAME>:<tag> --owner <repository owner>
         uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-name: ${{ env.IMAGE_NAME }}
@@ -481,13 +493,13 @@ jobs:
             echo
             echo "Verify provenance:"
             echo '```'
-            echo "gh attestation verify oci://${IMAGE_NAME}@${MERGED_DIGEST} --owner block"
+            printf 'gh attestation verify oci://%s@%s --owner %s\n' "$IMAGE_NAME" "$MERGED_DIGEST" "$GITHUB_REPOSITORY_OWNER"
             echo '```'
             if [[ "$VARIANT" == "release" ]]; then
               echo
               echo "Verify deployment eligibility:"
               echo '```'
-              echo "gh attestation verify oci://${IMAGE_NAME}@${MERGED_DIGEST} --repo block/buzz --signer-workflow block/buzz/.github/workflows/docker.yml --predicate-type https://buzz.block.xyz/attestations/deployment-eligibility/v1 --source-digest ${SOURCE_SHA}"
+              printf 'gh attestation verify oci://%s@%s --repo %s --signer-workflow %s/.github/workflows/docker.yml --predicate-type https://buzz.block.xyz/attestations/deployment-eligibility/v1 --source-digest %s\n' "$IMAGE_NAME" "$MERGED_DIGEST" "$GITHUB_REPOSITORY" "$GITHUB_REPOSITORY" "$SOURCE_SHA"
               echo '```'
             fi
           } >> "$GITHUB_STEP_SUMMARY"
@@ -510,6 +522,11 @@ jobs:
             runner: ubuntu-24.04-arm
             arch: arm64
     steps:
+      - name: Normalize image names
+        shell: bash
+        run: |
+          printf 'IMAGE_NAME=%s\nPUSH_GATEWAY_IMAGE=%s\n' "${IMAGE_NAME,,}" "${PUSH_GATEWAY_IMAGE,,}" >> "$GITHUB_ENV"
+
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
@@ -539,7 +556,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9  # v6.1.0
         with:
-          images: ghcr.io/block/buzz-push-gateway
+          images: ${{ env.PUSH_GATEWAY_IMAGE }}
           labels: |
             org.opencontainers.image.title=Buzz Push Gateway
             org.opencontainers.image.description=Capability-gated APNs last hop for Buzz
@@ -552,9 +569,9 @@ jobs:
           file: ./Dockerfile.push-gateway
           platforms: ${{ matrix.platform }}
           labels: ${{ steps.meta.outputs.labels }}
-          outputs: type=image,name=ghcr.io/block/buzz-push-gateway,push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
-          cache-from: type=registry,ref=ghcr.io/block/buzz-push-gateway-buildcache:${{ matrix.arch }}
-          cache-to: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref=ghcr.io/block/buzz-push-gateway-buildcache:{0},mode=max,compression=zstd', matrix.arch) || '' }}
+          outputs: type=image,name=${{ env.PUSH_GATEWAY_IMAGE }},push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
+          cache-from: type=registry,ref=${{ env.PUSH_GATEWAY_IMAGE }}-buildcache:${{ matrix.arch }}
+          cache-to: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref={0}-buildcache:{1},mode=max,compression=zstd', env.PUSH_GATEWAY_IMAGE, matrix.arch) || '' }}
       - name: Export digest
         if: github.event_name != 'pull_request'
         env:
@@ -614,6 +631,11 @@ jobs:
       id-token: write
       attestations: write
     steps:
+      - name: Normalize image names
+        shell: bash
+        run: |
+          printf 'IMAGE_NAME=%s\nPUSH_GATEWAY_IMAGE=%s\n' "${IMAGE_NAME,,}" "${PUSH_GATEWAY_IMAGE,,}" >> "$GITHUB_ENV"
+
       - name: Download per-arch digests
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
@@ -632,7 +654,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9  # v6.1.0
         with:
-          images: ghcr.io/block/buzz-push-gateway
+          images: ${{ env.PUSH_GATEWAY_IMAGE }}
           tags: |
             type=ref,event=branch,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
             type=sha,prefix=sha-,format=short,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
@@ -646,15 +668,15 @@ jobs:
         run: |
           set -euo pipefail
           tags=(); while IFS= read -r tag; do [ -n "$tag" ] && tags+=("-t" "$tag"); done <<< "$META_TAGS"
-          digests=(); for digest in *; do digests+=("ghcr.io/block/buzz-push-gateway@sha256:${digest}"); done
+          digests=(); for digest in *; do digests+=("${PUSH_GATEWAY_IMAGE}@sha256:${digest}"); done
           docker buildx imagetools create "${tags[@]}" "${digests[@]}"
           first_tag=$(echo "$META_TAGS" | head -n1)
           digest=$(docker buildx imagetools inspect "$first_tag" --format '{{json .Manifest}}' | jq -r '.digest')
           echo "digest=${digest}" >> "$GITHUB_OUTPUT"
       - name: Attest gateway image provenance
         uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
-          subject-name: ghcr.io/block/buzz-push-gateway
+          subject-name: ${{ env.PUSH_GATEWAY_IMAGE }}
           subject-digest: ${{ steps.manifest.outputs.digest }}
           push-to-registry: true
       - name: Gateway publication summary
@@ -664,7 +686,7 @@ jobs:
         run: |
           set -euo pipefail
           {
-            echo "### Published \`ghcr.io/block/buzz-push-gateway\`"
+            echo "### Published \`${PUSH_GATEWAY_IMAGE}\`"
             echo
             printf "**Digest:** \`%s\`\n" "$GATEWAY_DIGEST"
             echo
@@ -675,6 +697,6 @@ jobs:
             echo
             echo 'Verify provenance before deployment:'
             echo "\`\`\`"
-            printf 'gh attestation verify oci://ghcr.io/block/buzz-push-gateway@%s --owner block\n' "$GATEWAY_DIGEST"
+            printf 'gh attestation verify oci://%s@%s --owner %s\n' "$PUSH_GATEWAY_IMAGE" "$GATEWAY_DIGEST" "$GITHUB_REPOSITORY_OWNER"
             echo "\`\`\`"
           } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/helm-chart.yml

@@ -39,18 +39,24 @@ on:
       - "deploy/charts/buzz/**"
       - "deploy/charts/buzz-push-gateway/**"
       - ".github/workflows/helm-chart.yml"
+      - "scripts/package-chart.sh"
+      - "scripts/test-chart-packaging.sh"
       - "ct.yaml"
 
 # Match docker.yml: deny-by-default, each job grants only what it needs.
 permissions: {}
 
 env:
+  IMAGE_REPOSITORY: ${{ vars.GHCR_IMAGE != '' && vars.GHCR_IMAGE || format('ghcr.io/{0}', github.repository) }}
+  # Fork Docker builds publish main; upstream retains the chart's appVersion.
+  IMAGE_TAG: ${{ github.repository != 'block/buzz' && 'main' || '' }}
   # Single source of truth for the OCI chart repository (helm appends the chart
-  # name `buzz`, yielding oci://ghcr.io/block/buzz/charts/buzz, which is exactly
-  # the install ref documented in deploy/charts/buzz/README.md). Set
-  # GHCR_CHART_REPO as a repo variable to override (e.g., forks pushing to their
-  # own namespace without editing this file) — mirrors docker.yml's GHCR_IMAGE.
-  CHART_REPO: ${{ vars.GHCR_CHART_REPO != '' && vars.GHCR_CHART_REPO || 'oci://ghcr.io/block/buzz/charts' }}
+  # name `buzz`, yielding oci://ghcr.io/<owner>/<repo>/charts/buzz; upstream
+  # that is the install ref documented in deploy/charts/buzz/README.md). The
+  # default follows the running repository so forks publish to their own
+  # namespace. Set GHCR_CHART_REPO as a repo variable to override — mirrors
+  # docker.yml's GHCR_IMAGE.
+  CHART_REPO: ${{ vars.GHCR_CHART_REPO != '' && vars.GHCR_CHART_REPO || format('oci://ghcr.io/{0}/charts', github.repository) }}
 
 jobs:
   lint-and-unittest:
@@ -86,6 +92,9 @@ jobs:
       - name: Build chart dependencies
         run: helm dependency build deploy/charts/buzz
 
+      - name: Verify packaged image defaults
+        run: scripts/test-chart-packaging.sh deploy/charts/buzz
+
       - name: Push gateway chart lint + render guard
         run: deploy/charts/buzz-push-gateway/tests/render.sh
 
@@ -165,6 +174,11 @@ jobs:
       contents: read
       packages: write    # push the chart to GHCR
     steps:
+      - name: Normalize chart repository
+        shell: bash
+        run: |
+          printf 'CHART_REPO=%s\n' "${CHART_REPO,,}" >> "$GITHUB_ENV"
+
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
@@ -226,7 +240,7 @@ jobs:
         run: helm dependency build deploy/charts/buzz
 
       - name: Package chart
-        run: helm package deploy/charts/buzz --destination dist
+        run: scripts/package-chart.sh deploy/charts/buzz "$IMAGE_REPOSITORY" "$IMAGE_TAG" dist
 
       - name: Push chart to GHCR
         env:
@@ -241,7 +255,7 @@ jobs:
           CHART_REPO: ${{ env.CHART_REPO }}
           VERSION: ${{ steps.ver.outputs.version }}
         run: |
-          # CHART_REPO is oci://ghcr.io/block/buzz/charts; helm push appends the
+          # CHART_REPO is oci://ghcr.io/<owner>/<repo>/charts; helm push appends the
           # chart name, so the install ref is .../charts/buzz.
           INSTALL_REF="${CHART_REPO}/buzz"
           {

.github/workflows/push-gateway-helm-chart.yml

@@ -16,9 +16,14 @@ on:
       - "deploy/charts/buzz-push-gateway/**"
       - "crates/buzz-push-gateway/src/config.rs"
       - ".github/workflows/push-gateway-helm-chart.yml"
+      - "scripts/package-chart.sh"
+      - "scripts/test-chart-packaging.sh"
 permissions: {}
 env:
-  CHART_REPO: oci://ghcr.io/block/buzz/charts
+  IMAGE_REPOSITORY: ${{ vars.GHCR_PUSH_GATEWAY_IMAGE != '' && vars.GHCR_PUSH_GATEWAY_IMAGE || format('ghcr.io/{0}-push-gateway', github.repository) }}
+  # Defaults to the running repository's namespace so forks publish to their
+  # own registry; GHCR_CHART_REPO overrides it (same variable as helm-chart.yml).
+  CHART_REPO: ${{ vars.GHCR_CHART_REPO != '' && vars.GHCR_CHART_REPO || format('oci://ghcr.io/{0}/charts', github.repository) }}
 jobs:
   validate:
     runs-on: ubuntu-latest
@@ -33,6 +38,7 @@ jobs:
         with: { version: v3.16.4 }
       - run: deploy/charts/buzz-push-gateway/tests/render.sh
       - run: deploy/charts/buzz-push-gateway/tests/release-contract.sh
+      - run: scripts/test-chart-packaging.sh deploy/charts/buzz-push-gateway
   publish:
     if: github.event_name != 'pull_request'
     needs: validate
@@ -41,6 +47,10 @@ jobs:
       contents: read
       packages: write
     steps:
+      - name: Normalize chart repository
+        shell: bash
+        run: |
+          printf 'CHART_REPO=%s\n' "${CHART_REPO,,}" >> "$GITHUB_ENV"
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
@@ -66,5 +76,5 @@ jobs:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - run: helm package deploy/charts/buzz-push-gateway --destination dist
+      - run: scripts/package-chart.sh deploy/charts/buzz-push-gateway "$IMAGE_REPOSITORY" main dist
       - run: helm push "dist/buzz-push-gateway-${VERSION}.tgz" "$CHART_REPO"

.github/workflows/sprig-image.yml

@@ -1,8 +1,9 @@
 name: Sprig image
 
 # Builds and publishes the public agent container image as
-# ghcr.io/block/buzz-sprig — the digest-pinned box the Kubernetes backend
-# deploys agents into (see Dockerfile.sprig and docs/remote-agents.md).
+# ghcr.io/<owner>/<repo>-sprig (ghcr.io/block/buzz-sprig upstream) — the
+# digest-pinned box the Kubernetes backend deploys agents into (see
+# Dockerfile.sprig and docs/remote-agents.md).
 #
 # Strategy mirrors docker.yml (the relay image): each architecture builds on
 # its native runner, pushes to GHCR by digest, then a merge job stitches the
@@ -17,7 +18,7 @@ name: Sprig image
 #   - workflow_dispatch             → manual publish at the current ref
 #
 # NOTE: the first push creates the GHCR package PRIVATE by default. An org
-# admin must flip ghcr.io/block/buzz-sprig to public once (Package settings →
+# admin must flip the sprig package to public once (Package settings →
 # Change visibility). Subsequent pushes keep the visibility.
 
 on:
@@ -46,9 +47,10 @@ concurrency:
 permissions: {}
 
 env:
-  # Single source of truth for the image name; override with the
-  # GHCR_SPRIG_IMAGE repo variable (same pattern as docker.yml).
-  IMAGE_NAME: ${{ vars.GHCR_SPRIG_IMAGE != '' && vars.GHCR_SPRIG_IMAGE || 'ghcr.io/block/buzz-sprig' }}
+  # Single source of truth for the image name; it defaults to the running
+  # repository's namespace so forks publish to their own registry. Override
+  # with the GHCR_SPRIG_IMAGE repo variable (same pattern as docker.yml).
+  IMAGE_NAME: ${{ vars.GHCR_SPRIG_IMAGE != '' && vars.GHCR_SPRIG_IMAGE || format('ghcr.io/{0}-sprig', github.repository) }}
 
 jobs:
   build:
@@ -72,6 +74,11 @@ jobs:
             arch: arm64
 
     steps:
+      - name: Normalize image name
+        shell: bash
+        run: |
+          printf 'IMAGE_NAME=%s\n' "${IMAGE_NAME,,}" >> "$GITHUB_ENV"
+
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
@@ -156,6 +163,11 @@ jobs:
       attestations: write
 
     steps:
+      - name: Normalize image name
+        shell: bash
+        run: |
+          printf 'IMAGE_NAME=%s\n' "${IMAGE_NAME,,}" >> "$GITHUB_ENV"
+
       - name: Download per-arch digests
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
@@ -213,7 +225,7 @@ jobs:
           echo "digest=${merged_digest}" >> "$GITHUB_OUTPUT"
 
       - name: Attest provenance for the merged image
-        # Verify with: gh attestation verify oci://ghcr.io/block/buzz-sprig:<tag> --owner block
+        # Verify with: gh attestation verify oci://<IMAGE_NAME>:<tag> --owner <repository owner>
         uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-name: ${{ env.IMAGE_NAME }}