P1 E9: Make released hub OCI package publicly pullable

[gnanirahulnutakki]

Problem

The v0.3.0-beta.4 release successfully publishes and signs ghcr.io/ardurai/sith-hub, but an unauthenticated manifest request is denied because the newly created GHCR package defaults to private visibility. That prevents the Helm chart and normal users from consuming the documented release-bound digest.

Acceptance criteria

• The release workflow explicitly sets the organization container package visibility to public using its least-privilege GitHub Actions token after publishing the immutable tag.
• A static release policy test prevents removal or reordering of that step.
• The next immutable beta release is independently proven publicly pullable by exact tag and digest, with linux/amd64 and linux/arm64 manifest entries.
• Cosign signature and GitHub provenance/SBOM attestations verify against the public digest.

Discovered during the post-release verification of #169 / v0.3.0-beta.4.

[gnanirahulnutakki]

Implementation correction: GitHub Packages does not expose a supported REST mutation to change a container package visibility. The OCI source label links the package to this repository for access permissions, but it does not make the package public.

This fix therefore makes the release fail closed after signing and provenance/SBOM attestation: it logs out of GHCR and must anonymously inspect the exact pushed digest before assets can be attached or the release published. The pre-release bootstrap is a one-time organization-package-admin action in GitHub Package Settings: change sith-hub visibility to Public. GitHub documents that a public package cannot be made private again.

v0.3.0-beta.4 remains a signed but private package; the next immutable tag will be cut only after that setting is confirmed and its anonymous digest gate can pass.

References: https://docs.github.com/en/enterprise-cloud@latest/packages/learn-github-packages/configuring-a-packages-access-control-and-visibility?apiVersion=2022-11-28 and https://docs.github.com/en/rest/packages/packages?apiVersion=2022-11-28

[gnanirahulnutakki]

Landed the fail-closed release guard in #173 (0e4be12). Exact post-merge dev CI passed, paired CodeQL passed, and GitHub security queues remain 0 Dependabot / 0 code-scanning / 0 secret-scanning alerts.

The issue remains open by design. An ArdurAI organization package admin must now make sith-hub public once at https://github.com/orgs/ArdurAI/packages/container/package/sith-hub/settings (Danger Zone → Change visibility → Public; irreversible). Only then will a fresh immutable tag be cut; the new workflow will reject the release unless the exact signed digest is anonymously pullable.

[gnanirahulnutakki]

Release-readiness PR #174 is now merged to main as 368b3a5. Exact-main CI passed, paired CodeQL passed, and the final security queue sweep is 0 Dependabot / 0 code scanning / 0 secret scanning.

The code and branch are ready for the next immutable beta tag. The remaining action is still the one-time package-admin setting: make sith-hub public in GitHub Package Settings, then confirm here. I will immediately prove anonymous access and cut the new tag; the workflow itself will refuse to publish if that proof fails.

[gnanirahulnutakki]

2026-07-17 anonymous-access refresh: the GHCR admin gate is still unresolved.

Using an isolated empty Docker config, an unauthenticated manifest inspection of ghcr.io/ardurai/sith-hub:v0.3.0-beta.4 still returns denied. No credentials or package settings were changed.

The code/release guards remain complete; the remaining action is the documented one-time ArdurAI package-admin visibility change. Do not cut a replacement immutable tag until the package is public, because the release workflow is designed to fail closed on the anonymous exact-digest proof.

[gnanirahulnutakki]

2026-07-17 20:56 CDT anonymous-access refresh:

Using crane with a fresh empty Docker configuration, anonymous token acquisition for ghcr.io/ardurai/sith-hub:v0.3.0-beta.4 still returns UNAUTHORIZED: authentication required. The current GitHub token also lacks read:packages, so no authenticated package state was inferred and no settings were changed.

The one-time organization package-admin visibility change remains required. Do not cut another immutable beta until anonymous exact-digest access succeeds; the release workflow remains correctly fail-closed.

[gnanirahulnutakki]

2026-07-18 12:06 CDT anonymous-access refresh:

Using crane with isolated empty HOME and Docker-config paths on the EXTENDED drive, anonymous access to the exact published beta.4 Hub digest
ghcr.io/ardurai/sith-hub@sha256:01375f26beb1494c6b72284914aa5f499cff7a179ee6668ced6cdd30fb22d74b
still returns UNAUTHORIZED: authentication required during token acquisition.

The current GitHub token also receives HTTP 403 from the package metadata endpoint because it lacks read:packages; no authenticated visibility state was inferred and no package setting was changed.

The one-time ArdurAI package-admin visibility change remains required. The release guard is correctly fail-closed, so no replacement immutable beta tag will be cut while anonymous exact-digest access fails. Work is moving to the next unblocked E10 child, #272.

[gnanirahulnutakki]

2026-07-19 00:40 CDT anonymous-access refresh:

Using crane with isolated empty HOME and Docker configuration paths on EXTENDED, with GitHub token variables removed, anonymous access to the exact published beta.4 Hub digest
ghcr.io/ardurai/sith-hub@sha256:01375f26beb1494c6b72284914aa5f499cff7a179ee6668ced6cdd30fb22d74b
still fails during token acquisition with UNAUTHORIZED: authentication required.

No credential or package setting was changed, and the empty probe directories were removed. The one-time ArdurAI package-admin visibility change remains required. Do not cut another immutable beta until anonymous exact-digest access succeeds; the release guard remains correctly fail-closed.

[gnanirahulnutakki]

2026-07-19 14:51 CDT anonymous-access refresh:

Using crane v0.20.3 with isolated empty HOME and Docker configuration directories on EXTENDED, with GitHub and registry token variables removed, anonymous access to the exact published beta.4 Hub digest
ghcr.io/ardurai/sith-hub@sha256:01375f26beb1494c6b72284914aa5f499cff7a179ee6668ced6cdd30fb22d74b
still fails during token acquisition with UNAUTHORIZED: authentication required.

The current GitHub token still receives HTTP 403 from the organization package metadata endpoint because it lacks read:packages; no authenticated visibility state was inferred and no package setting was changed. All isolated probe directories were removed after the check.

The remaining unblock condition is unchanged: an ArdurAI organization package admin must make sith-hub public once. Do not cut a replacement immutable beta until anonymous exact-digest access succeeds; the release workflow remains correctly fail-closed. Moving to the next unblocked Tier-A audit.