From e7ba2547be8566e16ead1ba48d5c820305007a66 Mon Sep 17 00:00:00 2001
From: Kailas Mahavarkar <66670953+KailasMahavarkar@users.noreply.github.com>
Date: Fri, 10 Apr 2026 17:44:42 +0530
Subject: [PATCH] fix(ci): switch Docker registry from ghcr.io to Docker Hub

ghcr.io defaults to private and requires manual visibility changes
per-package. Docker Hub images are public by default.

- Workflow now logs into Docker Hub using DOCKERHUB_USERNAME +
  DOCKERHUB_TOKEN secrets and pushes to orkait/hyperstack
- Removed REGISTRY/IMAGE_NAME env vars (no longer needed)
- Removed packages: write permission (not needed for Docker Hub)
- install.md updated: image reference changed to orkait/hyperstack:latest
- Troubleshooting section updated to reflect Docker Hub

Requires two repo secrets to be set:
  DOCKERHUB_USERNAME=<your Docker Hub username>
  DOCKERHUB_TOKEN=<Docker Hub access token>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/publish.yml | 14 ++++----------
 install.md                    | 17 +++++------------
 2 files changed, 9 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 44267e5..5bc3e71 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -5,10 +5,6 @@ on:
     branches: ['main']
   pull_request:
 
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-
 jobs:
   verify:
     name: Verify (${{ matrix.os }}, Bun ${{ matrix.bun-version }})
@@ -43,7 +39,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
-      packages: write
 
     steps:
       - name: Checkout repository
@@ -71,20 +66,19 @@ jobs:
             --title "v${{ steps.check.outputs.version }}" \
             --generate-notes
 
-      - name: Log in to GitHub Container Registry
+      - name: Log in to Docker Hub
         if: steps.check.outputs.new == 'true'
         uses: docker/login-action@v3
         with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Extract metadata (tags, labels) for Docker
         if: steps.check.outputs.new == 'true'
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          images: orkait/hyperstack
 
       - name: Build and push Docker image
         if: steps.check.outputs.new == 'true'
diff --git a/install.md b/install.md
index effbc9e..a696ac5 100644
--- a/install.md
+++ b/install.md
@@ -49,7 +49,7 @@ If Docker is available, add the following configuration to the appropriate MCP c
         "--rm",
         "--memory=256m",
         "--cpus=0.5",
-        "ghcr.io/orkait/hyperstack:main"
+        "orkait/hyperstack:latest"
       ]
     }
   }
@@ -108,23 +108,16 @@ If installation failed at any step, report the specific error and what would nee
 
 ## Troubleshooting
 
-### MCP server shows as failed / `unauthorized` when pulling the Docker image
+### MCP server shows as failed / cannot pull the Docker image
 
-This means the Docker image is private. The image at `ghcr.io/orkait/hyperstack:main` must be set to public for unauthenticated pulls to work.
+Verify the image is accessible: `docker pull orkait/hyperstack:latest`
 
-To fix:
-1. Go to [github.com/orgs/orkait/packages/container/hyperstack](https://github.com/orgs/orkait/packages/container/hyperstack)
-2. Click **Package settings**
-3. Under **Danger Zone**, click **Change visibility**
-4. Set to **Public**
-5. Re-run `docker pull ghcr.io/orkait/hyperstack:main` to verify
-
-Reference: [GitHub Docs - Configuring a package's access control and visibility](https://docs.github.com/en/packages/learn-github-packages/configuring-a-packages-access-control-and-visibility)
+If the pull fails, confirm Docker is running and you have an internet connection. The image is public on Docker Hub - no authentication is required to pull it.
 
 ### MCP server starts but tools return no results
 
 The MCP config file may point to the wrong binary or the server is not running. Verify:
-- Docker: run `docker run -i --rm ghcr.io/orkait/hyperstack:main` and confirm it starts without error
+- Docker: run `docker run -i --rm orkait/hyperstack:latest` and confirm it starts without error
 - Local Bun: confirm the absolute path in `args` exists (`ls /path/to/hyperstack/bin/hyperstack.mjs`)
 - Restart the CLI/IDE after any config change - MCP servers are loaded at startup