From e45aa4162a6146ca9dc17c48d44e10f06a3d20da Mon Sep 17 00:00:00 2001
From: Benjamin Toby <devops@tben.me>
Date: Thu, 22 Oct 2026 13:57:30 +0100
Subject: [PATCH] Give each registry its own release leg, so Gitea cannot fail
 a release

Cloudflare rate limits git.tben.me's blob uploads (429/1015), which failed
the first v0.1.0 image even though GHCR had already pushed every tag.
---
 .github/workflows/release.yml | 51 +++++++++++++++++++----------------
 1 file changed, 28 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5be541d..867d660 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,8 +14,24 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  # One leg per registry, so a registry having a bad day (Cloudflare rate
+  # limits git.tben.me's blob uploads) can never fail the release image that
+  # the installer installs from by default.
   image:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - registry: ghcr.io
+            login_username: ${{ github.actor }}
+            login_password: ${{ secrets.GITHUB_TOKEN }}
+            soft: "false"
+          - registry: git.tben.me
+            login_username: ${{ secrets.GITEA_USERNAME }}
+            login_password: ${{ secrets.GITEA_TOKEN }}
+            soft: "true"
+    continue-on-error: ${{ matrix.soft }}
     steps:
       - uses: actions/checkout@v4
 
@@ -23,25 +39,19 @@ jobs:
 
       - uses: docker/setup-buildx-action@v3
 
-      - name: Log in to GHCR
+      - name: Log in to ${{ matrix.registry }}
         uses: docker/login-action@v3
         with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Log in to Gitea
-        uses: docker/login-action@v3
-        with:
-          registry: git.tben.me
-          username: ${{ secrets.GITEA_USERNAME }}
-          password: ${{ secrets.GITEA_TOKEN }}
+          registry: ${{ matrix.registry }}
+          username: ${{ matrix.login_username }}
+          password: ${{ matrix.login_password }}
 
       - name: Work out image tags
         id: tags
         env:
           EVENT: ${{ github.event_name }}
           RELEASE_TAG: ${{ github.event.release.tag_name }}
+          REGISTRY: ${{ matrix.registry }}
         run: |
           set -euo pipefail
           sha="sha-${GITHUB_SHA::12}"
@@ -49,18 +59,13 @@ jobs:
             version="$RELEASE_TAG"
             minor="$(printf '%s' "$version" | sed -E 's/^v?([0-9]+)\.([0-9]+).*/\1.\2/')"
             tags="$(printf '%s\n' \
-              "ghcr.io/moduletrace/cobble:latest" \
-              "ghcr.io/moduletrace/cobble:${version}" \
-              "ghcr.io/moduletrace/cobble:${minor}" \
-              "ghcr.io/moduletrace/cobble:${sha}" \
-              "git.tben.me/moduletrace/cobble:latest" \
-              "git.tben.me/moduletrace/cobble:${version}" \
-              "git.tben.me/moduletrace/cobble:${minor}" \
-              "git.tben.me/moduletrace/cobble:${sha}")"
+              "${REGISTRY}/moduletrace/cobble:latest" \
+              "${REGISTRY}/moduletrace/cobble:${version}" \
+              "${REGISTRY}/moduletrace/cobble:${minor}" \
+              "${REGISTRY}/moduletrace/cobble:${sha}")"
           else
             tags="$(printf '%s\n' \
-              "ghcr.io/moduletrace/cobble:${sha}" \
-              "git.tben.me/moduletrace/cobble:${sha}")"
+              "${REGISTRY}/moduletrace/cobble:${sha}")"
           fi
           {
             echo "tags<<EOF"
@@ -78,5 +83,5 @@ jobs:
           tags: ${{ steps.tags.outputs.tags }}
           provenance: false
           sbom: false
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=${{ matrix.registry }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.registry }}