From 61a8b080acc420645e1abc12e5f158045af30939 Mon Sep 17 00:00:00 2001
From: Wabo <admin@wabo.cc>
Date: Fri, 15 May 2026 23:59:00 -0400
Subject: [PATCH] Point all image references at ghcr.io/wabolabs/wabosign

The image now lives at GHCR (pushed manually as :latest and
:sha-45ed368a). Aligning the rest of the repo to match:

- docker-compose.yml: image: ghcr.io/wabolabs/wabosign:latest
- README.md docker-run example: same
- .github/workflows/docker.yml: meta.images and login-action repointed
  at ghcr.io. Login now uses the auto-provisioned GITHUB_TOKEN with a
  job-level `permissions: packages: write`; the DOCKERHUB_USERNAME /
  DOCKERHUB_TOKEN secrets are no longer needed and can be removed from
  the repo settings. Also adds a `type=raw,value=latest` tag so the
  semver-triggered build keeps :latest pointing at the newest release.
- REBRANDING.md: registry note updated for accuracy.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .github/workflows/docker.yml | 16 +++++++++++-----
 README.md                    |  2 +-
 REBRANDING.md                |  2 +-
 docker-compose.yml           |  2 +-
 4 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 58e259e8..28542a17 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -9,6 +9,9 @@ jobs:
   build:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
 
     steps:
     - name: Checkout code
@@ -20,8 +23,10 @@ jobs:
       id: meta
       uses: docker/metadata-action@v4
       with:
-        images: wabolabs/wabosign
-        tags: type=semver,pattern={{version}}
+        images: ghcr.io/wabolabs/wabosign
+        tags: |
+          type=semver,pattern={{version}}
+          type=raw,value=latest
 
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v3
@@ -32,11 +37,12 @@ jobs:
     - name: Create .version file
       run: echo ${{ github.ref_name }} > .version
 
-    - name: Login to Docker Hub
+    - name: Login to GitHub Container Registry
       uses: docker/login-action@v3
       with:
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_TOKEN }}
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Build and push Docker image
       uses: docker/build-push-action@v6
diff --git a/README.md b/README.md
index 3db8332e..05b4bc08 100644
--- a/README.md
+++ b/README.md
@@ -40,7 +40,7 @@ WaboSign is a fork of [DocuSeal](https://github.com/docusealco/docuseal) under A
 ## Docker
 
 ```sh
-docker run --name wabosign -p 3000:3000 -v .:/data wabolabs/wabosign
+docker run --name wabosign -p 3000:3000 -v .:/data ghcr.io/wabolabs/wabosign:latest
 ```
 
 By default the container uses SQLite for data. Point at PostgreSQL or MySQL by setting `DATABASE_URL`.
diff --git a/REBRANDING.md b/REBRANDING.md
index 80ac2711..79d90c87 100644
--- a/REBRANDING.md
+++ b/REBRANDING.md
@@ -41,7 +41,7 @@ Scope: ~183 files modified. Decisions were made in a planning conversation befor
 - New migration [db/migrate/20260515183000_rename_docuseal_aatl_cert.rb](db/migrate/20260515183000_rename_docuseal_aatl_cert.rb) updates the AATL cert `name` field inside encrypted JSON value blobs from `docuseal_aatl` → `wabosign_aatl`
 - `AATL_CERT_NAME` constant updated accordingly
 - [Dockerfile](Dockerfile): user, group, home directory, and workdir renamed `docuseal` → `wabosign`
-- [docker-compose.yml](docker-compose.yml): image, volume, and Postgres DB name → `wabolabs/wabosign` / `wabosign`
+- [docker-compose.yml](docker-compose.yml): image, volume, and Postgres DB name → `ghcr.io/wabolabs/wabosign` / `wabosign`
 - [config/database.yml](config/database.yml): dev/test DB names → `wabosign_dev` / `wabosign_test`
 - [.github/workflows/ci.yml](.github/workflows/ci.yml) and [.github/workflows/docker.yml](.github/workflows/docker.yml): image name and test DB renamed
 - `docuseal.env` config file path → `wabosign.env` in [config/dotenv.rb](config/dotenv.rb)
diff --git a/docker-compose.yml b/docker-compose.yml
index ba6171d3..c6415b18 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,7 +3,7 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
-    image: wabolabs/wabosign:latest
+    image: ghcr.io/wabolabs/wabosign:latest
     ports:
       - 3000:3000
     volumes: