From 50d393e619ad79ff81a1e4e928b24149b9f39e47 Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Fri, 15 Aug 2025 08:48:12 +0200
Subject: [PATCH 01/20] refactor!: Restructure rust-prepare action

---
 .github/actions/rust-prepare/action.yml      | 34 +++--------
 .github/actions/rust-prepare/prepare.sh      | 64 ++++++++++++++++++++
 .github/actions/rust-prepare/prepare_git.sh  |  5 --
 .github/actions/rust-prepare/prepare_rust.sh | 31 ----------
 .github/actions/rust-prepare/prepare_ssh.sh  | 18 ------
 .github/workflows/docker-backend.yml         | 10 ++-
 .github/workflows/publish-crate.yml          | 16 +++--
 .github/workflows/rust-workflow.yml          | 17 ++----
 8 files changed, 89 insertions(+), 106 deletions(-)
 create mode 100644 .github/actions/rust-prepare/prepare.sh
 delete mode 100755 .github/actions/rust-prepare/prepare_git.sh
 delete mode 100755 .github/actions/rust-prepare/prepare_rust.sh
 delete mode 100755 .github/actions/rust-prepare/prepare_ssh.sh

diff --git a/.github/actions/rust-prepare/action.yml b/.github/actions/rust-prepare/action.yml
index aa282d5..54bb9d4 100644
--- a/.github/actions/rust-prepare/action.yml
+++ b/.github/actions/rust-prepare/action.yml
@@ -4,25 +4,17 @@ inputs:
   ssh_auth_sock:
     description: "SSH socket"
     default: "/tmp/ssh_agent.sock"
-    required: true
-  gitlab_ssh:
-    description: "Gitlab ssh"
-    required: true
-  gitlab_user:
-    description: "Gitlab username"
-    required: true
-  gitlab_pass:
-    description: "Gitlab username"
-    required: true
   cargo_home:
     description: "Cargo home"
     default: ".cargo"
-  famedly_crates_registry:
+  famedly_crate_registry_name:
     description: "Famedly registry name"
     default: "famedly"
-  famedly_crates_registry_index:
+  famedly_crate_registry_index_url:
     description: "URL of famedly registry index"
     default: "ssh://git@ssh.shipyard.rs/famedly/crate-index.git"
+  famedly_crate_registry_ssh_privkey:
+    description: "SSH private key for authenticating with famedly registry index. This needs to be set for a private registry to be configured."
   additional_packages:
     description: "Additional package to install during preparation"
     default: ""
@@ -33,19 +25,9 @@ runs:
     - shell: bash
       env:
         SSH_AUTH_SOCK: ${{ inputs.ssh_auth_sock }}
-        GITLAB_SSH: ${{ inputs.gitlab_ssh }}
-      run: $GITHUB_ACTION_PATH/prepare_ssh.sh
-
-    - shell: bash
-      env:
-        GITLAB_USER: ${{ inputs.gitlab_user }}
-        GITLAB_PASS: ${{ inputs.gitlab_pass }}
-      run: $GITHUB_ACTION_PATH/prepare_git.sh
-
-    - shell: bash
-      env:
         CARGO_HOME: ${{ inputs.cargo_home }}
         ADDITIONAL_PACKAGES: ${{ inputs.additional_packages }}
-        FAMEDLY_CRATES_REGISTRY: ${{ inputs.famedly_crates_registry }}
-        FAMEDLY_CRATES_REGISTRY_INDEX: ${{ inputs.famedly_crates_registry_index }}
-      run: $GITHUB_ACTION_PATH/prepare_rust.sh
+        FAMEDLY_CRATE_REGISTRY_NAME: ${{ inputs.famedly_crate_registry_name }}
+        FAMEDLY_CRATE_REGISTRY_INDEX_URL: ${{ inputs.famedly_crate_registry_index_url }}
+        FAMEDLY_CRATE_REGISTRY_SSH_PRIVKEY: ${{ inputs.famedly_crate_registry_ssh_privkey }}
+      run: $GITHUB_ACTION_PATH/prepare.sh
diff --git a/.github/actions/rust-prepare/prepare.sh b/.github/actions/rust-prepare/prepare.sh
new file mode 100644
index 0000000..4617dde
--- /dev/null
+++ b/.github/actions/rust-prepare/prepare.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "Preparing Rust build environment"
+
+# Ensure repo path is safe
+git config --global --add safe.directory "$(pwd)"
+
+# Determine sudo availability (works inside and outside containers)
+if [[ "$(id -u)" -eq 0 ]]; then
+	SUDO=""
+else
+	SUDO="sudo"
+fi
+
+echo "Installing additional packages: ${ADDITIONAL_PACKAGES}"
+if [[ -n "${ADDITIONAL_PACKAGES}" ]]; then
+	$SUDO apt-get install -yqq --no-install-recommends "${ADDITIONAL_PACKAGES}"
+else
+	echo "No additional packages specified. Skipping installation."
+fi
+
+echo "Setting up build environment"
+echo "CARGO_HOME = ${HOME}/${CARGO_HOME}"
+mkdir -p "${HOME}/${CARGO_HOME}"
+
+# Decide public/private mode based on presence of private key
+if [[ -z "${FAMEDLY_CRATE_REGISTRY_SSH_PRIVKEY:-}" ]]; then
+	echo "No private registry SSH key provided. Configuring for public builds."
+	export FAMEDLY_CRATE_REGISTRY_NAME="crates-io"
+else
+	echo "Private registry credentials detected. Configuring SSH and private registry access."
+	USER_NAME="$(whoami)"
+	SSH_HOME="$(getent passwd "$USER_NAME" | cut -d: -f6)"
+	ssh-agent -a "${SSH_AUTH_SOCK}" > /dev/null
+	echo "SSH_AUTH_SOCK=${SSH_AUTH_SOCK}" >> "$GITHUB_ENV"
+	ssh-add -vvv - <<< "${FAMEDLY_CRATE_REGISTRY_SSH_PRIVKEY}"$'\n'
+	mkdir -p "$SSH_HOME/.ssh"
+	{
+		ssh-keyscan -H ssh.shipyard.rs
+	} >> "$SSH_HOME/.ssh/known_hosts"
+fi
+
+cat << EOF >> "${HOME}/${CARGO_HOME}/config.toml"
+[net]
+git-fetch-with-cli = true
+EOF
+
+if [ "$FAMEDLY_CRATE_REGISTRY_NAME" != "crates-io" ]; then
+	cat << EOF >> "${HOME}/${CARGO_HOME}/config.toml"
+[registries.${FAMEDLY_CRATE_REGISTRY_NAME}]
+index = "${FAMEDLY_CRATE_REGISTRY_INDEX_URL}"
+EOF
+fi
+
+echo "CARGO_HOME=${HOME}/${CARGO_HOME}" >> "$GITHUB_ENV"
+
+# Persist registry settings for subsequent GitHub Actions steps
+echo "FAMEDLY_CRATE_REGISTRY_NAME=${FAMEDLY_CRATE_REGISTRY_NAME}" >> "$GITHUB_ENV"
+if [[ -n "${FAMEDLY_CRATE_REGISTRY_INDEX_URL:-}" ]]; then
+	echo "FAMEDLY_CRATE_REGISTRY_INDEX_URL=${FAMEDLY_CRATE_REGISTRY_INDEX_URL}" >> "$GITHUB_ENV"
+fi
+
+echo "Preparations finished"
diff --git a/.github/actions/rust-prepare/prepare_git.sh b/.github/actions/rust-prepare/prepare_git.sh
deleted file mode 100755
index ffa3a4a..0000000
--- a/.github/actions/rust-prepare/prepare_git.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-echo "Setting up git credentials"
-echo "https://${GITLAB_USER}:${GITLAB_PASS}@gitlab.com" >> ~/.git-credentials
-git config --global credential.helper store
-git config --global --add safe.directory "$(pwd)"
diff --git a/.github/actions/rust-prepare/prepare_rust.sh b/.github/actions/rust-prepare/prepare_rust.sh
deleted file mode 100755
index 0c2c6c7..0000000
--- a/.github/actions/rust-prepare/prepare_rust.sh
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/usr/bin/env bash
-# If we are root, there is no sudo command (needed). Makes sure we can run inside a docker container and outside.
-if [[ "$(id -u)" -eq 0 ]]; then
-	SUDO=""
-else
-	SUDO="sudo"
-fi
-
-echo "Installing additional packages: ${ADDITIONAL_PACKAGES}"
-$SUDO apt-get install -yqq --no-install-recommends "${ADDITIONAL_PACKAGES}"
-
-echo "Setting up development environment"
-
-echo "CARGO_HOME = ${HOME}/${CARGO_HOME}"
-mkdir -p "${HOME}/${CARGO_HOME}"
-
-cat << EOF >> "${HOME}/${CARGO_HOME}/config.toml"
-[net]
-git-fetch-with-cli = true
-EOF
-
-if [ "$FAMEDLY_CRATES_REGISTRY" != "crates-io" ]; then
-    cat << EOF >> "${HOME}/${CARGO_HOME}/config.toml"
-[registries.${FAMEDLY_CRATES_REGISTRY}]
-index = "${FAMEDLY_CRATES_REGISTRY_INDEX}"
-EOF
-fi
-
-echo "CARGO_HOME=${HOME}/${CARGO_HOME}" >> "$GITHUB_ENV"
-
-echo "Preparations finished"
diff --git a/.github/actions/rust-prepare/prepare_ssh.sh b/.github/actions/rust-prepare/prepare_ssh.sh
deleted file mode 100755
index 64a214b..0000000
--- a/.github/actions/rust-prepare/prepare_ssh.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-echo "Preparing Rust build environment"
-
-echo "Setting up SSH"
-USER="$(whoami)"
-SSH_HOME="$(getent passwd "$USER" | cut -d: -f6)" # Is different from $HOME in docker containers, because github CI..
-ssh-agent -a "${SSH_AUTH_SOCK}" > /dev/null
-echo "SSH_AUTH_SOCK=${SSH_AUTH_SOCK}" >> "$GITHUB_ENV"
-ssh-add -vvv - <<< "${GITLAB_SSH}"$'\n' # ensure newline at the end of key
-
-echo "Adding public keys of remotes our CI interacts with"
-mkdir -p "$SSH_HOME/.ssh"
-
-{
-    ssh-keyscan -H gitlab.com
-    ssh-keyscan -H github.com
-    ssh-keyscan -H ssh.shipyard.rs
-} >> "$SSH_HOME/.ssh/known_hosts"
diff --git a/.github/workflows/docker-backend.yml b/.github/workflows/docker-backend.yml
index b435eb8..6258b3e 100644
--- a/.github/workflows/docker-backend.yml
+++ b/.github/workflows/docker-backend.yml
@@ -18,12 +18,11 @@ on:
         default: ${{ vars.REGISTRY_USER }}
 
     secrets:
-      CI_SSH_PRIVATE_KEY:
+      famedly_crate_registry_ssh_privkey:
         required: false
         description: |
           Private SSH key to use for cargo dependencies that need to
-          either be fetched from private GitHub repositories or a
-          private registry.
+          be fetched from a private registry.
       registry_password:
         required: false
         description: |
@@ -31,7 +30,6 @@ on:
           unset, the GitHub token will be used instead.
 
 env:
-  RUSTC_WRAPPER: cachepot
   REGISTRY_SNAPSHOTS: registry.famedly.net/docker-nightly
   REGISTRY_RELEASES: registry.famedly.net/docker-releases
   REGISTRY_OSS: registry.famedly.net/docker-oss
@@ -47,9 +45,9 @@ jobs:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
         run: |
           mkdir -p ~/.ssh
-          ssh-keyscan github.com >> ~/.ssh/known_hosts
+          ssh-keyscan git.shipyard.rs >> ~/.ssh/known_hosts
           ssh-agent -a $SSH_AUTH_SOCK > /dev/null
-          ssh-add - <<< "${{ secrets.CI_SSH_PRIVATE_KEY }}" || true
+          ssh-add - <<< "${{ secrets.famedly_crate_registry_ssh_privkey }}" || true
 
       # TODO: consider adding an intermediate `docker build -t base_image --target base` step
       # if current version rebuilds base stage for each target without caching. Ideally we want
diff --git a/.github/workflows/publish-crate.yml b/.github/workflows/publish-crate.yml
index 21247b9..23d413a 100644
--- a/.github/workflows/publish-crate.yml
+++ b/.github/workflows/publish-crate.yml
@@ -30,10 +30,10 @@ on:
         description: "List of features to publish; space-separated list"
         type: string
     secrets:
-      CI_SSH_PRIVATE_KEY:
-        description: "SSH key to use for authentication against the crate index"
+      registry_index_ssh_key:
+        description: "SSH key to use for authentication against the registry crate index"
         required: true
-      registry-auth-token:
+      registry_auth_token:
         description: "Auth token for the registry to publish to"
         required: true
 
@@ -45,13 +45,11 @@ jobs:
     container: registry.famedly.net/docker-oss/rust-container:nightly
     steps:
       - uses: actions/checkout@v4
-      - uses: famedly/backend-build-workflows/.github/actions/rust-prepare@main
+      - uses: famedly/backend-build-workflows/.github/actions/rust-prepare@v4
         with:
-          gitlab_user: ${{ secrets.GITLAB_USER }}
-          gitlab_pass: ${{ secrets.GITLAB_PASS }}
-          gitlab_ssh: ${{ secrets.CI_SSH_PRIVATE_KEY }}
-          famedly_crates_registry: ${{ inputs.registry-name }}
-          famedly_crates_registry_index: ${{ inputs.registry-index }}
+          famedly_crate_registry: ${{ inputs.registry-name }}
+          famedly_crate_registry_index_url: ${{ inputs.registry-index }}
+          famedly_crate_registry_ssh_privkey: ${{ secrets.registry-index-ssh-key}}
       - name: Install registry token
         # Uses `echo` (bash built-in) to prevent leaking the token
         # through CLI args in /proc
diff --git a/.github/workflows/rust-workflow.yml b/.github/workflows/rust-workflow.yml
index a87d34f..48e68d1 100644
--- a/.github/workflows/rust-workflow.yml
+++ b/.github/workflows/rust-workflow.yml
@@ -27,12 +27,11 @@ on:
         type: string
 
     secrets:
-      CI_SSH_PRIVATE_KEY:
+      FAMEDLY_CRATE_REGISTRY_SSH_PRIVKEY:
         required: false
         description: |
           Private SSH key to use for cargo dependencies that need to
-          either be fetched from private GitHub repositories or a
-          private registry.
+          be fetched from a private registry.
       CODECOV_TOKEN:
         required: false
         description: |
@@ -58,11 +57,9 @@ jobs:
         repository: famedly/backend-build-workflows
         ref: ${{ inputs.ref }}
 
-    - uses: ./.github/actions/rust-prepare
+    - uses: ./.github/actions/rust-prepare@v4
       with:
-        gitlab_ssh: ${{ secrets.CI_SSH_PRIVATE_KEY}}
-        gitlab_user: ${{ secrets.GITLAB_USER }}
-        gitlab_pass: ${{ secrets.GITLAB_PASS }}
+        famedly_crate_registry_ssh_privkey: ${{ secrets.SHIPYARD_SSH_PRIVATE_KEY}}
 
     - name: Checkout the repository to test
       uses: actions/checkout@v4
@@ -96,11 +93,9 @@ jobs:
         repository: famedly/backend-build-workflows
         ref: ${{ inputs.ref }}
 
-    - uses: ./.github/actions/rust-prepare
+    - uses: ./.github/actions/rust-prepare@v4
       with:
-        gitlab_ssh: ${{ secrets.CI_SSH_PRIVATE_KEY}}
-        gitlab_user: ${{ secrets.GITLAB_USER }}
-        gitlab_pass: ${{ secrets.GITLAB_PASS }}
+        famedly_crate_registry_ssh_privkey: ${{ secrets.SHIPYARD_SSH_PRIVATE_KEY}}
 
     - name: Checkout the repository to test
       uses: actions/checkout@v4

From fc0933a797dd6763b15df882b146b6a22fc3ecf1 Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Wed, 10 Sep 2025 14:59:22 +0200
Subject: [PATCH 02/20] refactor!: Adapt workflows to new action

---
 .github/workflows/publish-crate.yml |  4 ++--
 .github/workflows/rust-workflow.yml | 12 ++++++------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/publish-crate.yml b/.github/workflows/publish-crate.yml
index 23d413a..e4eb990 100644
--- a/.github/workflows/publish-crate.yml
+++ b/.github/workflows/publish-crate.yml
@@ -30,7 +30,7 @@ on:
         description: "List of features to publish; space-separated list"
         type: string
     secrets:
-      registry_index_ssh_key:
+      famedly_crate_registry_ssh_privkey:
         description: "SSH key to use for authentication against the registry crate index"
         required: true
       registry_auth_token:
@@ -49,7 +49,7 @@ jobs:
         with:
           famedly_crate_registry: ${{ inputs.registry-name }}
           famedly_crate_registry_index_url: ${{ inputs.registry-index }}
-          famedly_crate_registry_ssh_privkey: ${{ secrets.registry-index-ssh-key}}
+          famedly_crate_registry_ssh_privkey: ${{ secrets.famedly_crate_registry_ssh_privkey}}
       - name: Install registry token
         # Uses `echo` (bash built-in) to prevent leaking the token
         # through CLI args in /proc
diff --git a/.github/workflows/rust-workflow.yml b/.github/workflows/rust-workflow.yml
index 48e68d1..1950ee8 100644
--- a/.github/workflows/rust-workflow.yml
+++ b/.github/workflows/rust-workflow.yml
@@ -27,12 +27,12 @@ on:
         type: string
 
     secrets:
-      FAMEDLY_CRATE_REGISTRY_SSH_PRIVKEY:
+      famedly_crate_registry_ssh_privkey:
         required: false
         description: |
           Private SSH key to use for cargo dependencies that need to
           be fetched from a private registry.
-      CODECOV_TOKEN:
+      codecov_token:
         required: false
         description: |
           Token to use when publishing code coverage results to
@@ -59,7 +59,7 @@ jobs:
 
     - uses: ./.github/actions/rust-prepare@v4
       with:
-        famedly_crate_registry_ssh_privkey: ${{ secrets.SHIPYARD_SSH_PRIVATE_KEY}}
+        famedly_crate_registry_ssh_privkey: ${{ secrets.famedly_crate_registry_ssh_privkey}}
 
     - name: Checkout the repository to test
       uses: actions/checkout@v4
@@ -95,7 +95,7 @@ jobs:
 
     - uses: ./.github/actions/rust-prepare@v4
       with:
-        famedly_crate_registry_ssh_privkey: ${{ secrets.SHIPYARD_SSH_PRIVATE_KEY}}
+        famedly_crate_registry_ssh_privkey: ${{ secrets.famedly_crate_registry_ssh_privkey}}
 
     - name: Checkout the repository to test
       uses: actions/checkout@v4
@@ -115,10 +115,10 @@ jobs:
     - name: Codecov - Upload coverage
       uses: codecov/codecov-action@v4
       with:
-        token: ${{secrets.CODECOV_TOKEN}}
+        token: ${{secrets.codecov_token}}
         files: "lcov.info"
 
     - name: Codecov - Upload test results
       uses: codecov/test-results-action@v1
       with:
-        token: ${{secrets.CODECOV_TOKEN}}
+        token: ${{secrets.codecov_token}}

From ac44f8c0252e43b9b7c38a4d8f710abc5b731fcc Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Wed, 10 Sep 2025 15:13:57 +0200
Subject: [PATCH 03/20] refactor!: Clarify inputs as OCI registry

---
 .github/workflows/docker-backend.yml | 40 ++++++++++++++--------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/docker-backend.yml b/.github/workflows/docker-backend.yml
index 6258b3e..2a55baa 100644
--- a/.github/workflows/docker-backend.yml
+++ b/.github/workflows/docker-backend.yml
@@ -12,10 +12,10 @@ on:
         required: true
         type: string
 
-      registry_user:
+      oci_registry_user:
         required: false
         type: string
-        default: ${{ vars.REGISTRY_USER }}
+        default: ${{ vars.OCI_REGISTRY_USER }}
 
     secrets:
       famedly_crate_registry_ssh_privkey:
@@ -23,16 +23,16 @@ on:
         description: |
           Private SSH key to use for cargo dependencies that need to
           be fetched from a private registry.
-      registry_password:
+      oci_registry_password:
         required: false
         description: |
           The password to use to push to the docker registry. If left
           unset, the GitHub token will be used instead.
 
 env:
-  REGISTRY_SNAPSHOTS: registry.famedly.net/docker-nightly
-  REGISTRY_RELEASES: registry.famedly.net/docker-releases
-  REGISTRY_OSS: registry.famedly.net/docker-oss
+  OCI_REGISTRY_SNAPSHOTS: registry.famedly.net/docker-nightly
+  OCI_REGISTRY_RELEASES: registry.famedly.net/docker-releases
+  OCI_REGISTRY_OSS: registry.famedly.net/docker-oss
 
 jobs:
   docker-publish:
@@ -70,28 +70,28 @@ jobs:
             echo "::endgroup::"
           done
 
-      - name: Resolve registry to push
+      - name: Resolve OCI registry to push
         shell: bash
         run: |
           if [ ${{ github.ref_type }} = 'branch' ]; then
-            echo "REGISTRY=${{ env.REGISTRY_SNAPSHOTS }}" >> $GITHUB_ENV
+            echo "OCI_REGISTRY=${{ env.OCI_REGISTRY_SNAPSHOTS }}" >> $GITHUB_ENV
           elif [ ${{ github.ref_type }} = 'tag' ]; then
             if [[ ${{ inputs.oss }} == true ]]; then
-              echo "REGISTRY=${{ env.REGISTRY_OSS }}" >> $GITHUB_ENV
+              echo "OCI_REGISTRY=${{ env.OCI_REGISTRY_OSS }}" >> $GITHUB_ENV
             else
-              echo "REGISTRY=${{ env.REGISTRY_RELEASES }}" >> $GITHUB_ENV
+              echo "OCI_REGISTRY=${{ env.OCI_REGISTRY_RELEASES }}" >> $GITHUB_ENV
             fi
             if ! [[ ${{ github.ref_name }} =~ v[0-9]+\.[0-9]+\.[0-9]+ ]]; then
-              echo "REGISTRY=${{ env.REGISTRY_SNAPSHOTS }}" >> $GITHUB_ENV
+              echo "OCI_REGISTRY=${{ env.OCI_REGISTRY_SNAPSHOTS }}" >> $GITHUB_ENV
             fi
           fi
 
       - name: Tag
         shell: bash
-        if: env.REGISTRY != null
+        if: env.OCI_REGISTRY != null
         run: |
           for target in $(echo "${{ inputs.targets }}" | tr ',' '\n'); do
-            IMAGE_PATH="${{ env.REGISTRY }}/${target}"
+            IMAGE_PATH="${{ env.OCI_REGISTRY }}/${target}"
             echo "::group::Tagging ${IMAGE_PATH}"
 
             if [ ${{ github.ref_type }} = 'branch' ]; then
@@ -111,20 +111,20 @@ jobs:
             echo "::endgroup::"
           done
 
-      - name: Log into registry ${{ env.REGISTRY }}
+      - name: Log into registry ${{ env.OCI_REGISTRY }}
         uses: famedly/login-action@v2
-        if: env.REGISTRY != null
+        if: env.OCI_REGISTRY != null
         with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ inputs.registry_user }}
-          password: ${{ secrets.registry_password || secrets.GITHUB_TOKEN }}
+          registry: ${{ env.OCI_REGISTRY }}
+          username: ${{ inputs.oci_registry_user }}
+          password: ${{ secrets.oci_registry_password || secrets.GITHUB_TOKEN }}
 
       - name: Push
-        if: env.REGISTRY != null
+        if: env.OCI_REGISTRY != null
         shell: bash
         run: |
           for target in $(echo "${{ inputs.targets }}" | tr ',' '\n'); do
-            IMAGE_PATH="${{ env.REGISTRY }}/${target}"
+            IMAGE_PATH="${{ env.OCI_REGISTRY }}/${target}"
             echo "::group::Pushing ${IMAGE_PATH}"
             docker image push --all-tags "${IMAGE_PATH}"
             echo "::endgroup::"

From 270905ecaa390e8973e3d21de88289589c8ddef1 Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Wed, 10 Sep 2025 15:34:37 +0200
Subject: [PATCH 04/20] refactor!: Rename crate publish inputs to be consistent

---
 .github/workflows/publish-crate.yml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/publish-crate.yml b/.github/workflows/publish-crate.yml
index e4eb990..97ec5cf 100644
--- a/.github/workflows/publish-crate.yml
+++ b/.github/workflows/publish-crate.yml
@@ -15,11 +15,11 @@ name: Publish Rust crates
 on:
   workflow_call:
     inputs:
-      registry-name:
+      famedly_crate_registry_name:
         description: "Name of the registry to publish to"
         type: string
         default: "famedly"
-      registry-index:
+      famedly_crate_registry_index_url:
         description: "URL of the registry index"
         type: string
         default: "ssh://git@ssh.shipyard.rs/famedly/crate-index.git"
@@ -33,7 +33,7 @@ on:
       famedly_crate_registry_ssh_privkey:
         description: "SSH key to use for authentication against the registry crate index"
         required: true
-      registry_auth_token:
+      famedly_crate_registry_auth_token:
         description: "Auth token for the registry to publish to"
         required: true
 
@@ -47,19 +47,19 @@ jobs:
       - uses: actions/checkout@v4
       - uses: famedly/backend-build-workflows/.github/actions/rust-prepare@v4
         with:
-          famedly_crate_registry: ${{ inputs.registry-name }}
-          famedly_crate_registry_index_url: ${{ inputs.registry-index }}
+          famedly_crate_registry: ${{ inputs.famedly_crate_registry_name }}
+          famedly_crate_registry_index_url: ${{ inputs.famedly_crate_registry_index_url }}
           famedly_crate_registry_ssh_privkey: ${{ secrets.famedly_crate_registry_ssh_privkey}}
       - name: Install registry token
         # Uses `echo` (bash built-in) to prevent leaking the token
         # through CLI args in /proc
         run: |
           cat << EOF > "${CARGO_HOME}/credentials.toml"
-          [${{ inputs.registry-name != 'crates-io' && format('registries.{0}', inputs.registry-name) || 'registry' }}]
-          token = "${{ secrets.registry-auth-token }}"
+          [${{ inputs.famedly_crate_registry_name != 'crates-io' && format('registries.{0}', inputs.famedly_crate_registry_name) || 'registry' }}]
+          token = "${{ secrets.famedly_crate_registry_auth_token }}"
           EOF
       - name: Publish
         run: |
-          cargo publish ${{ inputs.registry-name != 'crates-io' && format('--registry {0}', inputs.registry-name) || '' }} \
+          cargo publish ${{ inputs.famedly_crate_registry_name != 'crates-io' && format('--registry {0}', inputs.famedly_crate_registry_name) || '' }} \
             ${{ inputs.packages != null && format('--package {0}', inputs.packages) || '' }} \
             ${{ inputs.features != null && format('--features {0}', inputs.features) || '' }}

From 19928d2671b5e5a128df3c2f2b30cd30406d05b4 Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Wed, 10 Sep 2025 15:38:38 +0200
Subject: [PATCH 05/20] refactor!: Rename inputs to snake_case

---
 .github/workflows/rust-workflow.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/rust-workflow.yml b/.github/workflows/rust-workflow.yml
index 1950ee8..31e24a0 100644
--- a/.github/workflows/rust-workflow.yml
+++ b/.github/workflows/rust-workflow.yml
@@ -3,12 +3,12 @@ name: Rust workflow
 on:
   workflow_call:
     inputs:
-      runs-on:
+      runs_on:
         required: false
         type: string
         default: ubuntu-latest
 
-      run-doctests:
+      run_doctests:
         description: |
           Whether to run doctests.
 
@@ -48,7 +48,7 @@ env:
 # Defined CI jobs.
 jobs:
   rust-lints:
-    runs-on: ${{ inputs.runs-on }}
+    runs-on: ${{ inputs.runs_on }}
     container: registry.famedly.net/docker-oss/rust-container:nightly
     steps:
     - name: Checkout workflow dependencies
@@ -84,7 +84,7 @@ jobs:
       run: typos # TODO: Use the typos action
 
   rust-tests:
-    runs-on: ${{ inputs.runs-on }}
+    runs-on: ${{ inputs.runs_on }}
     container: registry.famedly.net/docker-oss/rust-container:nightly
     steps:
     - name: Checkout workflow dependencies
@@ -109,7 +109,7 @@ jobs:
 
     - name: Doc-test
       shell: bash
-      if: inputs.run-doctests
+      if: inputs.run_doctests
       run: cargo +${NIGHTLY_VERSION} test --doc --workspace --verbose ${{inputs.test_args}}
 
     - name: Codecov - Upload coverage

From e62d17903c9141e41816e363a4d53f2e2154033a Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Wed, 10 Sep 2025 15:38:51 +0200
Subject: [PATCH 06/20] docs: Add v3 to v4 migration guide

---
 README.md | 97 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 97 insertions(+)

diff --git a/README.md b/README.md
index dc19b41..695a2d8 100644
--- a/README.md
+++ b/README.md
@@ -28,3 +28,100 @@ jobs:
       path: ./foo/bar # path to where the Dockerfile resides
       name: bar # name of service
 ```
+
+## Migration guide: v3 → v4
+
+### Summary of breaking changes
+- Inputs, secrets and env vars have been renamed for clarity and consistency.
+- GitHub SSH authentication was removed, only the private Famedly crate registry via SSH is supported. Cargo Git dependencies are *no longer supported*!
+- The `rust-prepare` action is consolidated into a single `prepare.sh` and auto-configures public vs private registry access.
+- All remaining GitLab references have been removed.
+
+### Composite action: `.github/actions/rust-prepare`
+
+| v3 (old) | v4 (new) | Notes |
+| --- | --- | --- |
+| `famedly_crates_registry` | `famedly_crate_registry` ||
+| `famedly_crates_registry_index` | `famedly_crate_registry_index_url` ||
+| (new) | `famedly_crate_registry_ssh_privkey` | SSH private key for the private registry index. Optional; when omitted, builds use `crates-io`. |
+| `FAMEDLY_CRATES_REGISTRY` | `FAMEDLY_CRATE_REGISTRY` ||
+| `FAMEDLY_CRATES_REGISTRY_INDEX` | `FAMEDLY_CRATE_REGISTRY_INDEX` ||
+
+Behavioural notes:
+- If `famedly_crate_registry_ssh_privkey` is not provided, the action configures `CARGO_HOME` for public `crates-io` only.
+- Use the action via a branch ref: `famedly/backend-build-workflows/.github/actions/rust-prepare@v4`.
+
+### Workflow: `.github/workflows/docker-backend.yml`
+### Renamed inputs and environment variables
+| v3 (old) | v4 (new) |
+| --- | --- | --- |
+| `inputs.registry_user` | `inputs.oci_registry_user` |
+| `secrets.CI_SSH_PRIVATE_KEY` | `secrets.famedly_crate_registry_ssh_privkey` |
+| `secrets.registry_password` | `secrets.oci_registry_password` |
+| `REGISTRY_SNAPSHOTS/RELEASES/OSS` | `OCI_REGISTRY_SNAPSHOTS/RELEASES/OSS` |
+| `REGISTRY` | `OCI_REGISTRY` |
+
+### Workflow: `.github/workflows/publish-crate.yml`
+#### Renamed inputs and secrets
+
+| v3 (old) | v4 (new) |
+| --- | --- | --- |
+| `uses: famedly/backend-build-workflows/.github/actions/rust-prepare@main` | `@v4` |
+| `secrets.CI_SSH_PRIVATE_KEY` | `secrets.famedly_crate_registry_ssh_privkey` |
+| `secrets.registry-auth-token` | `secrets.registry_auth_token` |
+| `with.famedly_crates_registry` | `with.famedly_crate_registry` | 
+| `with.famedly_crates_registry_index` | `with.famedly_crate_registry_index_url` |
+### Workflow: `.github/workflows/rust-workflow.yml`
+#### Renamed inputs
+
+| v3 (old) | v4 (new) |
+| --- | --- | --- |
+| `secrets.CI_SSH_PRIVATE_KEY` | `secrets.famedly_crate_registry_ssh_privkey` |
+| `secrets.CODECOV_TOKEN` | `secrets.codecov_token` |
+| `uses: ./.github/actions/rust-prepare` | `uses: ./.github/actions/rust-prepare@v4` |
+### Required user actions
+- Update all `uses:` references to the v4 tag.
+- Rename inputs, secrets and env vars as per the tables above.
+- If you rely on private crates in Famedly’s registry, pass `famedly_crate_registry_ssh_privkey` and the registry name/index. Otherwise omit it to use `crates-io`.
+- If you referenced `REGISTRY` variables in custom steps, switch to `OCI_REGISTRY` equivalents.
+
+### Minimal examples (v4)
+
+Rust prepare in a job:
+
+```yaml
+- uses: famedly/backend-build-workflows/.github/actions/rust-prepare@v4
+  with:
+    famedly_crate_registry_name: famedly
+    famedly_crate_registry_index_url: ssh://git@ssh.shipyard.rs/famedly/crate-index.git
+    famedly_crate_registry_ssh_privkey: ${{ secrets.famedly_crate_registry_ssh_privkey }}
+```
+
+Publish crates workflow call:
+
+```yaml
+jobs:
+  publish:
+    uses: famedly/backend-build-workflows/.github/workflows/publish-crate.yml@v4
+    secrets:
+      famedly_crate_registry_ssh_privkey: ${{ secrets.famedly_crate_registry_ssh_privkey }}
+      famedly_crate_registry_auth_token: ${{ secrets.famedly_crate_registry_auth_token }}
+    with:
+      famedly_crate_registry_name: famedly
+      famedly_crate_registry_index_url: ssh://git@ssh.shipyard.rs/famedly/crate-index.git
+```
+
+Docker backend workflow call:
+
+```yaml
+jobs:
+  publish:
+    uses: famedly/backend-build-workflows/.github/workflows/docker-backend.yml@v4
+    with:
+      targets: service-a,service-b
+      oci_registry_user: ${{ vars.OCI_REGISTRY_USER }}
+    secrets:
+      famedly_crate_registry_ssh_privkey: ${{ secrets.famedly_crate_registry_ssh_privkey }}
+      oci_registry_password: ${{ secrets.oci_registry_password }}
+```
+

From f411991b1a671d34cf2469be4dd54d42cf43545c Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Thu, 11 Sep 2025 09:04:06 +0200
Subject: [PATCH 07/20] fix: Use correct input name

---
 .github/workflows/publish-crate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish-crate.yml b/.github/workflows/publish-crate.yml
index 97ec5cf..42b030a 100644
--- a/.github/workflows/publish-crate.yml
+++ b/.github/workflows/publish-crate.yml
@@ -47,7 +47,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: famedly/backend-build-workflows/.github/actions/rust-prepare@v4
         with:
-          famedly_crate_registry: ${{ inputs.famedly_crate_registry_name }}
+          famedly_crate_registry_name: ${{ inputs.famedly_crate_registry_name }}
           famedly_crate_registry_index_url: ${{ inputs.famedly_crate_registry_index_url }}
           famedly_crate_registry_ssh_privkey: ${{ secrets.famedly_crate_registry_ssh_privkey}}
       - name: Install registry token

From 4b0608c7db92f548e79507015088d227baacea68 Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Thu, 11 Sep 2025 09:08:32 +0200
Subject: [PATCH 08/20] refactor!: Remove famedly prefix from crate registry
 vars

---
 .github/actions/rust-prepare/action.yml | 12 ++++++------
 .github/actions/rust-prepare/prepare.sh | 18 +++++++++---------
 .github/workflows/docker-backend.yml    |  6 +++---
 .github/workflows/publish-crate.yml     | 20 ++++++++++----------
 .github/workflows/rust-workflow.yml     |  6 +++---
 5 files changed, 31 insertions(+), 31 deletions(-)

diff --git a/.github/actions/rust-prepare/action.yml b/.github/actions/rust-prepare/action.yml
index 54bb9d4..f077ca4 100644
--- a/.github/actions/rust-prepare/action.yml
+++ b/.github/actions/rust-prepare/action.yml
@@ -7,13 +7,13 @@ inputs:
   cargo_home:
     description: "Cargo home"
     default: ".cargo"
-  famedly_crate_registry_name:
+  crate_registry_name:
     description: "Famedly registry name"
     default: "famedly"
-  famedly_crate_registry_index_url:
+  crate_registry_index_url:
     description: "URL of famedly registry index"
     default: "ssh://git@ssh.shipyard.rs/famedly/crate-index.git"
-  famedly_crate_registry_ssh_privkey:
+  crate_registry_ssh_privkey:
     description: "SSH private key for authenticating with famedly registry index. This needs to be set for a private registry to be configured."
   additional_packages:
     description: "Additional package to install during preparation"
@@ -27,7 +27,7 @@ runs:
         SSH_AUTH_SOCK: ${{ inputs.ssh_auth_sock }}
         CARGO_HOME: ${{ inputs.cargo_home }}
         ADDITIONAL_PACKAGES: ${{ inputs.additional_packages }}
-        FAMEDLY_CRATE_REGISTRY_NAME: ${{ inputs.famedly_crate_registry_name }}
-        FAMEDLY_CRATE_REGISTRY_INDEX_URL: ${{ inputs.famedly_crate_registry_index_url }}
-        FAMEDLY_CRATE_REGISTRY_SSH_PRIVKEY: ${{ inputs.famedly_crate_registry_ssh_privkey }}
+        CRATE_REGISTRY_NAME: ${{ inputs.crate_registry_name }}
+        CRATE_REGISTRY_INDEX_URL: ${{ inputs.crate_registry_index_url }}
+        CRATE_REGISTRY_SSH_PRIVKEY: ${{ inputs.crate_registry_ssh_privkey }}
       run: $GITHUB_ACTION_PATH/prepare.sh
diff --git a/.github/actions/rust-prepare/prepare.sh b/.github/actions/rust-prepare/prepare.sh
index 4617dde..71344b2 100644
--- a/.github/actions/rust-prepare/prepare.sh
+++ b/.github/actions/rust-prepare/prepare.sh
@@ -25,16 +25,16 @@ echo "CARGO_HOME = ${HOME}/${CARGO_HOME}"
 mkdir -p "${HOME}/${CARGO_HOME}"
 
 # Decide public/private mode based on presence of private key
-if [[ -z "${FAMEDLY_CRATE_REGISTRY_SSH_PRIVKEY:-}" ]]; then
+if [[ -z "${CRATE_REGISTRY_SSH_PRIVKEY:-}" ]]; then
 	echo "No private registry SSH key provided. Configuring for public builds."
-	export FAMEDLY_CRATE_REGISTRY_NAME="crates-io"
+	export CRATE_REGISTRY_NAME="crates-io"
 else
 	echo "Private registry credentials detected. Configuring SSH and private registry access."
 	USER_NAME="$(whoami)"
 	SSH_HOME="$(getent passwd "$USER_NAME" | cut -d: -f6)"
 	ssh-agent -a "${SSH_AUTH_SOCK}" > /dev/null
 	echo "SSH_AUTH_SOCK=${SSH_AUTH_SOCK}" >> "$GITHUB_ENV"
-	ssh-add -vvv - <<< "${FAMEDLY_CRATE_REGISTRY_SSH_PRIVKEY}"$'\n'
+	ssh-add -vvv - <<< "${CRATE_REGISTRY_SSH_PRIVKEY}"$'\n'
 	mkdir -p "$SSH_HOME/.ssh"
 	{
 		ssh-keyscan -H ssh.shipyard.rs
@@ -46,19 +46,19 @@ cat << EOF >> "${HOME}/${CARGO_HOME}/config.toml"
 git-fetch-with-cli = true
 EOF
 
-if [ "$FAMEDLY_CRATE_REGISTRY_NAME" != "crates-io" ]; then
+if [ "$CRATE_REGISTRY_NAME" != "crates-io" ]; then
 	cat << EOF >> "${HOME}/${CARGO_HOME}/config.toml"
-[registries.${FAMEDLY_CRATE_REGISTRY_NAME}]
-index = "${FAMEDLY_CRATE_REGISTRY_INDEX_URL}"
+[registries.${CRATE_REGISTRY_NAME}]
+index = "${CRATE_REGISTRY_INDEX_URL}"
 EOF
 fi
 
 echo "CARGO_HOME=${HOME}/${CARGO_HOME}" >> "$GITHUB_ENV"
 
 # Persist registry settings for subsequent GitHub Actions steps
-echo "FAMEDLY_CRATE_REGISTRY_NAME=${FAMEDLY_CRATE_REGISTRY_NAME}" >> "$GITHUB_ENV"
-if [[ -n "${FAMEDLY_CRATE_REGISTRY_INDEX_URL:-}" ]]; then
-	echo "FAMEDLY_CRATE_REGISTRY_INDEX_URL=${FAMEDLY_CRATE_REGISTRY_INDEX_URL}" >> "$GITHUB_ENV"
+echo "CRATE_REGISTRY_NAME=${CRATE_REGISTRY_NAME}" >> "$GITHUB_ENV"
+if [[ -n "${CRATE_REGISTRY_INDEX_URL:-}" ]]; then
+	echo "CRATE_REGISTRY_INDEX_URL=${CRATE_REGISTRY_INDEX_URL}" >> "$GITHUB_ENV"
 fi
 
 echo "Preparations finished"
diff --git a/.github/workflows/docker-backend.yml b/.github/workflows/docker-backend.yml
index 2a55baa..a32cb28 100644
--- a/.github/workflows/docker-backend.yml
+++ b/.github/workflows/docker-backend.yml
@@ -18,7 +18,7 @@ on:
         default: ${{ vars.OCI_REGISTRY_USER }}
 
     secrets:
-      famedly_crate_registry_ssh_privkey:
+      crate_registry_ssh_privkey:
         required: false
         description: |
           Private SSH key to use for cargo dependencies that need to
@@ -47,7 +47,7 @@ jobs:
           mkdir -p ~/.ssh
           ssh-keyscan git.shipyard.rs >> ~/.ssh/known_hosts
           ssh-agent -a $SSH_AUTH_SOCK > /dev/null
-          ssh-add - <<< "${{ secrets.famedly_crate_registry_ssh_privkey }}" || true
+          ssh-add - <<< "${{ secrets.crate_registry_ssh_privkey }}" || true
 
       # TODO: consider adding an intermediate `docker build -t base_image --target base` step
       # if current version rebuilds base stage for each target without caching. Ideally we want
@@ -63,7 +63,7 @@ jobs:
             echo "::group::Building ${target}"
 
             docker build --pull -t ${target} --target ${target} \
-              --build-arg CARGO_REGISTRIES_FAMEDLY_INDEX="${{ vars.CARGO_REGISTRIES_FAMEDLY_INDEX }}" \
+              --build-arg CARGO_REGISTRIES_FAMEDLY_INDEX="${{ vars.CRATE_REGISTRY_INDEX_URL }}" \
               --build-arg CARGO_BUILD_RUSTFLAGS="${CARGO_BUILD_RUSTFLAGS}" \
               --ssh default .
 
diff --git a/.github/workflows/publish-crate.yml b/.github/workflows/publish-crate.yml
index 42b030a..ca73308 100644
--- a/.github/workflows/publish-crate.yml
+++ b/.github/workflows/publish-crate.yml
@@ -15,11 +15,11 @@ name: Publish Rust crates
 on:
   workflow_call:
     inputs:
-      famedly_crate_registry_name:
+      crate_registry_name:
         description: "Name of the registry to publish to"
         type: string
         default: "famedly"
-      famedly_crate_registry_index_url:
+      crate_registry_index_url:
         description: "URL of the registry index"
         type: string
         default: "ssh://git@ssh.shipyard.rs/famedly/crate-index.git"
@@ -30,10 +30,10 @@ on:
         description: "List of features to publish; space-separated list"
         type: string
     secrets:
-      famedly_crate_registry_ssh_privkey:
+      crate_registry_ssh_privkey:
         description: "SSH key to use for authentication against the registry crate index"
         required: true
-      famedly_crate_registry_auth_token:
+      crate_registry_auth_token:
         description: "Auth token for the registry to publish to"
         required: true
 
@@ -47,19 +47,19 @@ jobs:
       - uses: actions/checkout@v4
       - uses: famedly/backend-build-workflows/.github/actions/rust-prepare@v4
         with:
-          famedly_crate_registry_name: ${{ inputs.famedly_crate_registry_name }}
-          famedly_crate_registry_index_url: ${{ inputs.famedly_crate_registry_index_url }}
-          famedly_crate_registry_ssh_privkey: ${{ secrets.famedly_crate_registry_ssh_privkey}}
+          crate_registry_name: ${{ inputs.crate_registry_name }}
+          crate_registry_index_url: ${{ inputs.crate_registry_index_url }}
+          crate_registry_ssh_privkey: ${{ secrets.crate_registry_ssh_privkey}}
       - name: Install registry token
         # Uses `echo` (bash built-in) to prevent leaking the token
         # through CLI args in /proc
         run: |
           cat << EOF > "${CARGO_HOME}/credentials.toml"
-          [${{ inputs.famedly_crate_registry_name != 'crates-io' && format('registries.{0}', inputs.famedly_crate_registry_name) || 'registry' }}]
-          token = "${{ secrets.famedly_crate_registry_auth_token }}"
+          [${{ inputs.crate_registry_name != 'crates-io' && format('registries.{0}', inputs.crate_registry_name) || 'registry' }}]
+          token = "${{ secrets.crate_registry_auth_token }}"
           EOF
       - name: Publish
         run: |
-          cargo publish ${{ inputs.famedly_crate_registry_name != 'crates-io' && format('--registry {0}', inputs.famedly_crate_registry_name) || '' }} \
+          cargo publish ${{ inputs.crate_registry_name != 'crates-io' && format('--registry {0}', inputs.crate_registry_name) || '' }} \
             ${{ inputs.packages != null && format('--package {0}', inputs.packages) || '' }} \
             ${{ inputs.features != null && format('--features {0}', inputs.features) || '' }}
diff --git a/.github/workflows/rust-workflow.yml b/.github/workflows/rust-workflow.yml
index 31e24a0..4169a94 100644
--- a/.github/workflows/rust-workflow.yml
+++ b/.github/workflows/rust-workflow.yml
@@ -27,7 +27,7 @@ on:
         type: string
 
     secrets:
-      famedly_crate_registry_ssh_privkey:
+      crate_registry_ssh_privkey:
         required: false
         description: |
           Private SSH key to use for cargo dependencies that need to
@@ -59,7 +59,7 @@ jobs:
 
     - uses: ./.github/actions/rust-prepare@v4
       with:
-        famedly_crate_registry_ssh_privkey: ${{ secrets.famedly_crate_registry_ssh_privkey}}
+        crate_registry_ssh_privkey: ${{ secrets.crate_registry_ssh_privkey}}
 
     - name: Checkout the repository to test
       uses: actions/checkout@v4
@@ -95,7 +95,7 @@ jobs:
 
     - uses: ./.github/actions/rust-prepare@v4
       with:
-        famedly_crate_registry_ssh_privkey: ${{ secrets.famedly_crate_registry_ssh_privkey}}
+        crate_registry_ssh_privkey: ${{ secrets.crate_registry_ssh_privkey}}
 
     - name: Checkout the repository to test
       uses: actions/checkout@v4

From b3014be16c68c2acf42f65cdc8a5d3c6d70eed62 Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Thu, 11 Sep 2025 10:30:56 +0200
Subject: [PATCH 09/20] chore: Uppercase all GHA secret and variable refs

---
 .github/workflows/docker-backend.yml |  8 ++++----
 .github/workflows/publish-crate.yml  | 10 +++++-----
 .github/workflows/rust-workflow.yml  | 12 ++++++------
 README.md                            | 29 +++++++++++++---------------
 4 files changed, 28 insertions(+), 31 deletions(-)

diff --git a/.github/workflows/docker-backend.yml b/.github/workflows/docker-backend.yml
index a32cb28..1b87332 100644
--- a/.github/workflows/docker-backend.yml
+++ b/.github/workflows/docker-backend.yml
@@ -18,12 +18,12 @@ on:
         default: ${{ vars.OCI_REGISTRY_USER }}
 
     secrets:
-      crate_registry_ssh_privkey:
+      CRATE_REGISTRY_SSH_PRIVKEY:
         required: false
         description: |
           Private SSH key to use for cargo dependencies that need to
           be fetched from a private registry.
-      oci_registry_password:
+      OCI_REGISTRY_PASSWORD:
         required: false
         description: |
           The password to use to push to the docker registry. If left
@@ -47,7 +47,7 @@ jobs:
           mkdir -p ~/.ssh
           ssh-keyscan git.shipyard.rs >> ~/.ssh/known_hosts
           ssh-agent -a $SSH_AUTH_SOCK > /dev/null
-          ssh-add - <<< "${{ secrets.crate_registry_ssh_privkey }}" || true
+          ssh-add - <<< "${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY }}" || true
 
       # TODO: consider adding an intermediate `docker build -t base_image --target base` step
       # if current version rebuilds base stage for each target without caching. Ideally we want
@@ -117,7 +117,7 @@ jobs:
         with:
           registry: ${{ env.OCI_REGISTRY }}
           username: ${{ inputs.oci_registry_user }}
-          password: ${{ secrets.oci_registry_password || secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.OCI_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
 
       - name: Push
         if: env.OCI_REGISTRY != null
diff --git a/.github/workflows/publish-crate.yml b/.github/workflows/publish-crate.yml
index ca73308..3f67163 100644
--- a/.github/workflows/publish-crate.yml
+++ b/.github/workflows/publish-crate.yml
@@ -30,10 +30,10 @@ on:
         description: "List of features to publish; space-separated list"
         type: string
     secrets:
-      crate_registry_ssh_privkey:
+      CRATE_REGISTRY_SSH_PRIVKEY:
         description: "SSH key to use for authentication against the registry crate index"
         required: true
-      crate_registry_auth_token:
+      CRATE_REGISTRY_AUTH_TOKEN:
         description: "Auth token for the registry to publish to"
         required: true
 
@@ -45,18 +45,18 @@ jobs:
     container: registry.famedly.net/docker-oss/rust-container:nightly
     steps:
       - uses: actions/checkout@v4
-      - uses: famedly/backend-build-workflows/.github/actions/rust-prepare@v4
+      - uses: ./.github/actions/rust-prepare@v4
         with:
           crate_registry_name: ${{ inputs.crate_registry_name }}
           crate_registry_index_url: ${{ inputs.crate_registry_index_url }}
-          crate_registry_ssh_privkey: ${{ secrets.crate_registry_ssh_privkey}}
+          crate_registry_ssh_privkey: ${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY}}
       - name: Install registry token
         # Uses `echo` (bash built-in) to prevent leaking the token
         # through CLI args in /proc
         run: |
           cat << EOF > "${CARGO_HOME}/credentials.toml"
           [${{ inputs.crate_registry_name != 'crates-io' && format('registries.{0}', inputs.crate_registry_name) || 'registry' }}]
-          token = "${{ secrets.crate_registry_auth_token }}"
+          token = "${{ secrets.CRATE_REGISTRY_AUTH_TOKEN }}"
           EOF
       - name: Publish
         run: |
diff --git a/.github/workflows/rust-workflow.yml b/.github/workflows/rust-workflow.yml
index 4169a94..6ad608f 100644
--- a/.github/workflows/rust-workflow.yml
+++ b/.github/workflows/rust-workflow.yml
@@ -27,12 +27,12 @@ on:
         type: string
 
     secrets:
-      crate_registry_ssh_privkey:
+      CRATE_REGISTRY_SSH_PRIVKEY:
         required: false
         description: |
           Private SSH key to use for cargo dependencies that need to
           be fetched from a private registry.
-      codecov_token:
+      CODECOV_TOKEN:
         required: false
         description: |
           Token to use when publishing code coverage results to
@@ -59,7 +59,7 @@ jobs:
 
     - uses: ./.github/actions/rust-prepare@v4
       with:
-        crate_registry_ssh_privkey: ${{ secrets.crate_registry_ssh_privkey}}
+        crate_registry_ssh_privkey: ${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY}}
 
     - name: Checkout the repository to test
       uses: actions/checkout@v4
@@ -95,7 +95,7 @@ jobs:
 
     - uses: ./.github/actions/rust-prepare@v4
       with:
-        crate_registry_ssh_privkey: ${{ secrets.crate_registry_ssh_privkey}}
+        crate_registry_ssh_privkey: ${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY}}
 
     - name: Checkout the repository to test
       uses: actions/checkout@v4
@@ -115,10 +115,10 @@ jobs:
     - name: Codecov - Upload coverage
       uses: codecov/codecov-action@v4
       with:
-        token: ${{secrets.codecov_token}}
+        token: ${{secrets.CODECOV_TOKEN}}
         files: "lcov.info"
 
     - name: Codecov - Upload test results
       uses: codecov/test-results-action@v1
       with:
-        token: ${{secrets.codecov_token}}
+        token: ${{secrets.CODECOV_TOKEN}}
diff --git a/README.md b/README.md
index 695a2d8..b95953d 100644
--- a/README.md
+++ b/README.md
@@ -56,8 +56,8 @@ Behavioural notes:
 | v3 (old) | v4 (new) |
 | --- | --- | --- |
 | `inputs.registry_user` | `inputs.oci_registry_user` |
-| `secrets.CI_SSH_PRIVATE_KEY` | `secrets.famedly_crate_registry_ssh_privkey` |
-| `secrets.registry_password` | `secrets.oci_registry_password` |
+| `secrets.CI_SSH_PRIVATE_KEY` | `secrets.CRATE_REGISTRY_SSH_PRIVKEY` |
+| `secrets.registry_password` | `secrets.OCI_REGISTRY_PASSWORD` |
 | `REGISTRY_SNAPSHOTS/RELEASES/OSS` | `OCI_REGISTRY_SNAPSHOTS/RELEASES/OSS` |
 | `REGISTRY` | `OCI_REGISTRY` |
 
@@ -67,8 +67,8 @@ Behavioural notes:
 | v3 (old) | v4 (new) |
 | --- | --- | --- |
 | `uses: famedly/backend-build-workflows/.github/actions/rust-prepare@main` | `@v4` |
-| `secrets.CI_SSH_PRIVATE_KEY` | `secrets.famedly_crate_registry_ssh_privkey` |
-| `secrets.registry-auth-token` | `secrets.registry_auth_token` |
+| `secrets.CI_SSH_PRIVATE_KEY` | `secrets.CRATE_REGISTRY_SSH_PRIVKEY` |
+| `secrets.registry-auth-token` | `secrets.CRATE_REGISTRY_AUTH_TOKEN` |
 | `with.famedly_crates_registry` | `with.famedly_crate_registry` | 
 | `with.famedly_crates_registry_index` | `with.famedly_crate_registry_index_url` |
 ### Workflow: `.github/workflows/rust-workflow.yml`
@@ -76,8 +76,8 @@ Behavioural notes:
 
 | v3 (old) | v4 (new) |
 | --- | --- | --- |
-| `secrets.CI_SSH_PRIVATE_KEY` | `secrets.famedly_crate_registry_ssh_privkey` |
-| `secrets.CODECOV_TOKEN` | `secrets.codecov_token` |
+| `secrets.CI_SSH_PRIVATE_KEY` | `secrets.CRATE_REGISTRY_SSH_PRIVKEY` |
+| `secrets.CODECOV_TOKEN` | `secrets.CODECOV_TOKEN` |
 | `uses: ./.github/actions/rust-prepare` | `uses: ./.github/actions/rust-prepare@v4` |
 ### Required user actions
 - Update all `uses:` references to the v4 tag.
@@ -92,9 +92,9 @@ Rust prepare in a job:
 ```yaml
 - uses: famedly/backend-build-workflows/.github/actions/rust-prepare@v4
   with:
-    famedly_crate_registry_name: famedly
-    famedly_crate_registry_index_url: ssh://git@ssh.shipyard.rs/famedly/crate-index.git
-    famedly_crate_registry_ssh_privkey: ${{ secrets.famedly_crate_registry_ssh_privkey }}
+    crate_registry_name: famedly
+    crate_registry_index_url: ssh://git@ssh.shipyard.rs/famedly/crate-index.git
+    crate_registry_ssh_privkey: ${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY }}
 ```
 
 Publish crates workflow call:
@@ -104,11 +104,9 @@ jobs:
   publish:
     uses: famedly/backend-build-workflows/.github/workflows/publish-crate.yml@v4
     secrets:
-      famedly_crate_registry_ssh_privkey: ${{ secrets.famedly_crate_registry_ssh_privkey }}
-      famedly_crate_registry_auth_token: ${{ secrets.famedly_crate_registry_auth_token }}
+      CRATE_REGISTRY_SSH_PRIVKEY: ${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY }}
+      CRATE_REGISTRY_AUTH_TOKEN: ${{ secrets.CRATE_REGISTRY_AUTH_TOKEN }}
     with:
-      famedly_crate_registry_name: famedly
-      famedly_crate_registry_index_url: ssh://git@ssh.shipyard.rs/famedly/crate-index.git
 ```
 
 Docker backend workflow call:
@@ -121,7 +119,6 @@ jobs:
       targets: service-a,service-b
       oci_registry_user: ${{ vars.OCI_REGISTRY_USER }}
     secrets:
-      famedly_crate_registry_ssh_privkey: ${{ secrets.famedly_crate_registry_ssh_privkey }}
-      oci_registry_password: ${{ secrets.oci_registry_password }}
+      CRATE_REGISTRY_SSH_PRIVKEY: ${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY }}
+      OCI_REGISTRY_PASSWORD: ${{ secrets.OCI_REGISTRY_PASSWORD }}
 ```
-

From 1763ebf9bef1b7fdb65eb2921f4f670eb8be59ea Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Thu, 11 Sep 2025 10:38:00 +0200
Subject: [PATCH 10/20] docs: Document GHA vars and secrets

---
 README.md | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/README.md b/README.md
index b95953d..1ce45a1 100644
--- a/README.md
+++ b/README.md
@@ -15,6 +15,25 @@ jobs:
       name: bar # name of service
 ```
 
+## GitHub Actions variables and secrets (v4)
+
+### Variables
+
+| Name | Used by | Required | Purpose |
+| --- | --- | --- | --- |
+| `OCI_REGISTRY_USER` | `.github/workflows/docker-backend.yml` (default for `inputs.oci_registry_user`) | Optional | Username for logging into the target OCI registry. |
+| `CRATE_REGISTRY_INDEX_URL` | `.github/workflows/docker-backend.yml` (Docker build arg `CARGO_REGISTRIES_FAMEDLY_INDEX`) | Optional | URL of the crate registry index used inside Docker builds. |
+
+### Secrets
+
+| Name | Used by | Required | Purpose |
+| --- | --- | --- | --- |
+| `CRATE_REGISTRY_SSH_PRIVKEY` | `.github/workflows/docker-backend.yml`, `.github/workflows/publish-crate.yml`, `.github/workflows/rust-workflow.yml` | Required in `publish-crate`; optional elsewhere | SSH private key for accessing the private crate registry index. |
+| `CRATE_REGISTRY_AUTH_TOKEN` | `.github/workflows/publish-crate.yml` | Required | Auth token used when publishing crates to the configured registry. |
+| `OCI_REGISTRY_PASSWORD` | `.github/workflows/docker-backend.yml` | Optional (falls back to `GITHUB_TOKEN`) | Password for logging into the target OCI registry when pushing images. |
+| `CODECOV_TOKEN` | `.github/workflows/rust-workflow.yml` | Optional | Token for uploading coverage and test results to Codecov. |
+| `GITHUB_TOKEN` | `.github/workflows/docker-backend.yml` | Implicit (provided by GitHub) | Fallback token for OCI login when `OCI_REGISTRY_PASSWORD` is not set. |
+
 should take care of everything
 
 ## Complex service with subfolders

From 5577e83afb9745f2363a9800ba2a216302911df7 Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Thu, 11 Sep 2025 10:44:56 +0200
Subject: [PATCH 11/20] refactor: Use var as default in publish workflow

---
 .github/workflows/publish-crate.yml | 4 ++--
 README.md                           | 7 ++++---
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish-crate.yml b/.github/workflows/publish-crate.yml
index 3f67163..acbe15a 100644
--- a/.github/workflows/publish-crate.yml
+++ b/.github/workflows/publish-crate.yml
@@ -18,11 +18,11 @@ on:
       crate_registry_name:
         description: "Name of the registry to publish to"
         type: string
-        default: "famedly"
+        default: "${{ vars.CRATE_REGISTRY_NAME }}"
       crate_registry_index_url:
         description: "URL of the registry index"
         type: string
-        default: "ssh://git@ssh.shipyard.rs/famedly/crate-index.git"
+        default: "${{ vars.CRATE_REGISTRY_INDEX_URL }}"
       packages:
         description: "List of packages to publish; space-separated list"
         type: string
diff --git a/README.md b/README.md
index 1ce45a1..ab383df 100644
--- a/README.md
+++ b/README.md
@@ -19,10 +19,11 @@ jobs:
 
 ### Variables
 
-| Name | Used by | Required | Purpose |
+| Name | Where it is consumed | Required | Purpose |
 | --- | --- | --- | --- |
-| `OCI_REGISTRY_USER` | `.github/workflows/docker-backend.yml` (default for `inputs.oci_registry_user`) | Optional | Username for logging into the target OCI registry. |
-| `CRATE_REGISTRY_INDEX_URL` | `.github/workflows/docker-backend.yml` (Docker build arg `CARGO_REGISTRIES_FAMEDLY_INDEX`) | Optional | URL of the crate registry index used inside Docker builds. |
+| `OCI_REGISTRY_USER` | docker-backend: default value for workflow input `inputs.oci_registry_user` | Optional | Username for logging into the target OCI registry. |
+| `CRATE_REGISTRY_NAME` | rust-prepare: default value for action input `inputs.crate_registry_name` | Optional | Name of the crate registry to configure (e.g., `famedly` or `crates-io`). |
+| `CRATE_REGISTRY_INDEX_URL` | rust-prepare: default value for action input `inputs.crate_registry_index_url`; docker-backend: passed to Docker as build-arg `CARGO_REGISTRIES_FAMEDLY_INDEX` | Optional | URL of the crate registry index used by the action and inside Docker builds. |
 
 ### Secrets
 

From f96a40e91d19f2c416b25676837369005e44b855 Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Thu, 11 Sep 2025 10:51:07 +0200
Subject: [PATCH 12/20] docs: Use variables

---
 README.md | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index ab383df..00e44cb 100644
--- a/README.md
+++ b/README.md
@@ -112,9 +112,9 @@ Rust prepare in a job:
 ```yaml
 - uses: famedly/backend-build-workflows/.github/actions/rust-prepare@v4
   with:
-    crate_registry_name: famedly
-    crate_registry_index_url: ssh://git@ssh.shipyard.rs/famedly/crate-index.git
-    crate_registry_ssh_privkey: ${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY }}
+    crate_registry_name: "${{ vars.CRATE_REGISTRY_NAME }}"
+    crate_registry_index_url: "${{ vars.CRATE_REGISTRY_INDEX_URL }}
+    crate_registry_ssh_privkey: "${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY }}"
 ```
 
 Publish crates workflow call:
@@ -124,8 +124,8 @@ jobs:
   publish:
     uses: famedly/backend-build-workflows/.github/workflows/publish-crate.yml@v4
     secrets:
-      CRATE_REGISTRY_SSH_PRIVKEY: ${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY }}
-      CRATE_REGISTRY_AUTH_TOKEN: ${{ secrets.CRATE_REGISTRY_AUTH_TOKEN }}
+      CRATE_REGISTRY_SSH_PRIVKEY: "${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY }}"
+      CRATE_REGISTRY_AUTH_TOKEN: "${{ secrets.CRATE_REGISTRY_AUTH_TOKEN }}"
     with:
 ```
 
@@ -136,9 +136,9 @@ jobs:
   publish:
     uses: famedly/backend-build-workflows/.github/workflows/docker-backend.yml@v4
     with:
-      targets: service-a,service-b
-      oci_registry_user: ${{ vars.OCI_REGISTRY_USER }}
+      targets: "service-a,service-b"
+      oci_registry_user: "${{ vars.OCI_REGISTRY_USER }}"
     secrets:
-      CRATE_REGISTRY_SSH_PRIVKEY: ${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY }}
-      OCI_REGISTRY_PASSWORD: ${{ secrets.OCI_REGISTRY_PASSWORD }}
+      CRATE_REGISTRY_SSH_PRIVKEY: "${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY }}"
+      OCI_REGISTRY_PASSWORD: "${{ secrets.OCI_REGISTRY_PASSWORD }}"
 ```

From d2a2c212367a2369c5373c1c4a9fae79d1da1675 Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Thu, 11 Sep 2025 15:16:08 +0200
Subject: [PATCH 13/20] docs: Fix markdown tables

---
 README.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 00e44cb..87a43ee 100644
--- a/README.md
+++ b/README.md
@@ -74,7 +74,7 @@ Behavioural notes:
 ### Workflow: `.github/workflows/docker-backend.yml`
 ### Renamed inputs and environment variables
 | v3 (old) | v4 (new) |
-| --- | --- | --- |
+| --- | --- |
 | `inputs.registry_user` | `inputs.oci_registry_user` |
 | `secrets.CI_SSH_PRIVATE_KEY` | `secrets.CRATE_REGISTRY_SSH_PRIVKEY` |
 | `secrets.registry_password` | `secrets.OCI_REGISTRY_PASSWORD` |
@@ -85,7 +85,7 @@ Behavioural notes:
 #### Renamed inputs and secrets
 
 | v3 (old) | v4 (new) |
-| --- | --- | --- |
+| --- | --- |
 | `uses: famedly/backend-build-workflows/.github/actions/rust-prepare@main` | `@v4` |
 | `secrets.CI_SSH_PRIVATE_KEY` | `secrets.CRATE_REGISTRY_SSH_PRIVKEY` |
 | `secrets.registry-auth-token` | `secrets.CRATE_REGISTRY_AUTH_TOKEN` |
@@ -95,7 +95,7 @@ Behavioural notes:
 #### Renamed inputs
 
 | v3 (old) | v4 (new) |
-| --- | --- | --- |
+| --- | --- |
 | `secrets.CI_SSH_PRIVATE_KEY` | `secrets.CRATE_REGISTRY_SSH_PRIVKEY` |
 | `secrets.CODECOV_TOKEN` | `secrets.CODECOV_TOKEN` |
 | `uses: ./.github/actions/rust-prepare` | `uses: ./.github/actions/rust-prepare@v4` |
@@ -107,13 +107,13 @@ Behavioural notes:
 
 ### Minimal examples (v4)
 
-Rust prepare in a job:
+Prepare rust action, with custom crate registry:
 
 ```yaml
 - uses: famedly/backend-build-workflows/.github/actions/rust-prepare@v4
   with:
     crate_registry_name: "${{ vars.CRATE_REGISTRY_NAME }}"
-    crate_registry_index_url: "${{ vars.CRATE_REGISTRY_INDEX_URL }}
+    crate_registry_index_url: "${{ vars.CRATE_REGISTRY_INDEX_URL }}"
     crate_registry_ssh_privkey: "${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY }}"
 ```
 

From 0f2954eec153041a455fb6bd023fbd5e87cd7439 Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Thu, 11 Sep 2025 15:23:44 +0200
Subject: [PATCH 14/20] docs: Fix incorrect names

---
 README.md | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index 87a43ee..4a9d17e 100644
--- a/README.md
+++ b/README.md
@@ -61,11 +61,11 @@ jobs:
 
 | v3 (old) | v4 (new) | Notes |
 | --- | --- | --- |
-| `famedly_crates_registry` | `famedly_crate_registry` ||
-| `famedly_crates_registry_index` | `famedly_crate_registry_index_url` ||
-| (new) | `famedly_crate_registry_ssh_privkey` | SSH private key for the private registry index. Optional; when omitted, builds use `crates-io`. |
-| `FAMEDLY_CRATES_REGISTRY` | `FAMEDLY_CRATE_REGISTRY` ||
-| `FAMEDLY_CRATES_REGISTRY_INDEX` | `FAMEDLY_CRATE_REGISTRY_INDEX` ||
+| `famedly_crates_registry` | `crate_registry_name` ||
+| `famedly_crates_registry_index` | `crate_registry_index_url` ||
+| (new) | `crate_registry_ssh_privkey` | SSH private key for the private registry index. Optional; when omitted, builds use `crates-io`. |
+| `FAMEDLY_CRATES_REGISTRY` | `CRATE_REGISTRY_NAME` ||
+| `FAMEDLY_CRATES_REGISTRY_INDEX` | `CRATE_REGISTRY_INDEX_URL` ||
 
 Behavioural notes:
 - If `famedly_crate_registry_ssh_privkey` is not provided, the action configures `CARGO_HOME` for public `crates-io` only.
@@ -89,8 +89,8 @@ Behavioural notes:
 | `uses: famedly/backend-build-workflows/.github/actions/rust-prepare@main` | `@v4` |
 | `secrets.CI_SSH_PRIVATE_KEY` | `secrets.CRATE_REGISTRY_SSH_PRIVKEY` |
 | `secrets.registry-auth-token` | `secrets.CRATE_REGISTRY_AUTH_TOKEN` |
-| `with.famedly_crates_registry` | `with.famedly_crate_registry` | 
-| `with.famedly_crates_registry_index` | `with.famedly_crate_registry_index_url` |
+| `with.famedly_crates_registry` | `with.crate_registry_name` | 
+| `with.famedly_crates_registry_index` | `with.crate_registry_index_url` |
 ### Workflow: `.github/workflows/rust-workflow.yml`
 #### Renamed inputs
 

From e438bc96e826c7c72ff503c999ae085ea088e88a Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Fri, 12 Sep 2025 08:41:23 +0200
Subject: [PATCH 15/20] refactor: Omit revision from local action references

---
 .github/workflows/publish-crate.yml | 4 ++--
 .github/workflows/rust-workflow.yml | 2 +-
 README.md                           | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish-crate.yml b/.github/workflows/publish-crate.yml
index acbe15a..4239388 100644
--- a/.github/workflows/publish-crate.yml
+++ b/.github/workflows/publish-crate.yml
@@ -42,10 +42,10 @@ jobs:
     # Enforce only publishing tagged commits
     if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
-    container: registry.famedly.net/docker-oss/rust-container:nightly
+    container: registry.famedly.net/docker-oss/rust-container:nightly 
     steps:
       - uses: actions/checkout@v4
-      - uses: ./.github/actions/rust-prepare@v4
+      - uses: ./.github/actions/rust-prepare
         with:
           crate_registry_name: ${{ inputs.crate_registry_name }}
           crate_registry_index_url: ${{ inputs.crate_registry_index_url }}
diff --git a/.github/workflows/rust-workflow.yml b/.github/workflows/rust-workflow.yml
index 6ad608f..191d09c 100644
--- a/.github/workflows/rust-workflow.yml
+++ b/.github/workflows/rust-workflow.yml
@@ -57,7 +57,7 @@ jobs:
         repository: famedly/backend-build-workflows
         ref: ${{ inputs.ref }}
 
-    - uses: ./.github/actions/rust-prepare@v4
+    - uses: ./.github/actions/rust-prepare
       with:
         crate_registry_ssh_privkey: ${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY}}
 
diff --git a/README.md b/README.md
index 4a9d17e..27fed3a 100644
--- a/README.md
+++ b/README.md
@@ -79,7 +79,7 @@ Behavioural notes:
 | `secrets.CI_SSH_PRIVATE_KEY` | `secrets.CRATE_REGISTRY_SSH_PRIVKEY` |
 | `secrets.registry_password` | `secrets.OCI_REGISTRY_PASSWORD` |
 | `REGISTRY_SNAPSHOTS/RELEASES/OSS` | `OCI_REGISTRY_SNAPSHOTS/RELEASES/OSS` |
-| `REGISTRY` | `OCI_REGISTRY` |
+| `REGISTRY` | `OCI_REGISTRY` | 
 
 ### Workflow: `.github/workflows/publish-crate.yml`
 #### Renamed inputs and secrets

From a90e95ee01fba91656562db7348979690802a37e Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Fri, 12 Sep 2025 08:43:30 +0200
Subject: [PATCH 16/20] chore: Use ghcr for rust-container

---
 .github/workflows/publish-crate.yml | 2 +-
 .github/workflows/rust-workflow.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish-crate.yml b/.github/workflows/publish-crate.yml
index 4239388..e9c7a4c 100644
--- a/.github/workflows/publish-crate.yml
+++ b/.github/workflows/publish-crate.yml
@@ -42,7 +42,7 @@ jobs:
     # Enforce only publishing tagged commits
     if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
-    container: registry.famedly.net/docker-oss/rust-container:nightly 
+    container: ghcr.io/famedly/rust-container:nightly
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/rust-prepare
diff --git a/.github/workflows/rust-workflow.yml b/.github/workflows/rust-workflow.yml
index 191d09c..8e0bf95 100644
--- a/.github/workflows/rust-workflow.yml
+++ b/.github/workflows/rust-workflow.yml
@@ -49,7 +49,7 @@ env:
 jobs:
   rust-lints:
     runs-on: ${{ inputs.runs_on }}
-    container: registry.famedly.net/docker-oss/rust-container:nightly
+    container: ghcr.io/famedly/rust-container:nightly
     steps:
     - name: Checkout workflow dependencies
       uses: actions/checkout@v4

From a39e8ea11a7fc9dabbea45af9083d0b480469ea4 Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Fri, 12 Sep 2025 08:49:06 +0200
Subject: [PATCH 17/20] docs: Document case changes to rust workflow inputs

---
 README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/README.md b/README.md
index 27fed3a..ca70e66 100644
--- a/README.md
+++ b/README.md
@@ -96,6 +96,8 @@ Behavioural notes:
 
 | v3 (old) | v4 (new) |
 | --- | --- |
+| `inputs.runs-on` | `inputs.runs_on` |
+| `inputs.run-doctests` | `inputs.run_doctests` |
 | `secrets.CI_SSH_PRIVATE_KEY` | `secrets.CRATE_REGISTRY_SSH_PRIVKEY` |
 | `secrets.CODECOV_TOKEN` | `secrets.CODECOV_TOKEN` |
 | `uses: ./.github/actions/rust-prepare` | `uses: ./.github/actions/rust-prepare@v4` |

From 10583e4e44566820a961d352e3f239fa40a2927c Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Fri, 12 Sep 2025 08:56:22 +0200
Subject: [PATCH 18/20] fix: Handle missing additional packages gracefully

---
 .github/actions/rust-prepare/prepare.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/actions/rust-prepare/prepare.sh b/.github/actions/rust-prepare/prepare.sh
index 71344b2..3f916a7 100644
--- a/.github/actions/rust-prepare/prepare.sh
+++ b/.github/actions/rust-prepare/prepare.sh
@@ -13,8 +13,8 @@ else
 	SUDO="sudo"
 fi
 
-echo "Installing additional packages: ${ADDITIONAL_PACKAGES}"
-if [[ -n "${ADDITIONAL_PACKAGES}" ]]; then
+if [[ -n "${ADDITIONAL_PACKAGES:-}" ]]; then
+  echo "Installing additional packages: ${ADDITIONAL_PACKAGES}"
 	$SUDO apt-get install -yqq --no-install-recommends "${ADDITIONAL_PACKAGES}"
 else
 	echo "No additional packages specified. Skipping installation."

From 7075ccb2c647fc7f72eaf7ab882b0aec5b2d8915 Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Fri, 12 Sep 2025 14:56:15 +0200
Subject: [PATCH 19/20] docs: Clarify usage of registry auth token

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index ca70e66..ec1272f 100644
--- a/README.md
+++ b/README.md
@@ -30,7 +30,7 @@ jobs:
 | Name | Used by | Required | Purpose |
 | --- | --- | --- | --- |
 | `CRATE_REGISTRY_SSH_PRIVKEY` | `.github/workflows/docker-backend.yml`, `.github/workflows/publish-crate.yml`, `.github/workflows/rust-workflow.yml` | Required in `publish-crate`; optional elsewhere | SSH private key for accessing the private crate registry index. |
-| `CRATE_REGISTRY_AUTH_TOKEN` | `.github/workflows/publish-crate.yml` | Required | Auth token used when publishing crates to the configured registry. |
+| `CRATE_REGISTRY_AUTH_TOKEN` | `.github/workflows/publish-crate.yml` | Required for publish-crate workflow | Auth token used when publishing crates to the configured registry. |
 | `OCI_REGISTRY_PASSWORD` | `.github/workflows/docker-backend.yml` | Optional (falls back to `GITHUB_TOKEN`) | Password for logging into the target OCI registry when pushing images. |
 | `CODECOV_TOKEN` | `.github/workflows/rust-workflow.yml` | Optional | Token for uploading coverage and test results to Codecov. |
 | `GITHUB_TOKEN` | `.github/workflows/docker-backend.yml` | Implicit (provided by GitHub) | Fallback token for OCI login when `OCI_REGISTRY_PASSWORD` is not set. |

From 5e4169061f1724b396bd9feab922d4dc5b15c8cd Mon Sep 17 00:00:00 2001
From: Emelie Graven <e.graven@famedly.com>
Date: Fri, 12 Sep 2025 15:05:52 +0200
Subject: [PATCH 20/20] refactor: Be explicit about word splitting

---
 .github/actions/rust-prepare/prepare.sh | 8 +++++++-
 README.md                               | 2 +-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/actions/rust-prepare/prepare.sh b/.github/actions/rust-prepare/prepare.sh
index 3f916a7..d86576d 100644
--- a/.github/actions/rust-prepare/prepare.sh
+++ b/.github/actions/rust-prepare/prepare.sh
@@ -15,11 +15,17 @@ fi
 
 if [[ -n "${ADDITIONAL_PACKAGES:-}" ]]; then
   echo "Installing additional packages: ${ADDITIONAL_PACKAGES}"
-	$SUDO apt-get install -yqq --no-install-recommends "${ADDITIONAL_PACKAGES}"
+	# We want to be explicit about word splitting here.
+	# https://github.com/koalaman/shellcheck/wiki/Sc2046
+	read -ra packages <<< "${ADDITIONAL_PACKAGES}"
+	$SUDO apt-get install -yqq --no-install-recommends "${packages[@]}"
 else
 	echo "No additional packages specified. Skipping installation."
 fi
 
+
+# TODO: Don't set CARGO_HOME to a relative path. It is supposed to be an absolute path, this is potentially problematic.
+# However, it works for now and any change to this needs to be thoroughly tested as github actions is really weird about runner home directories.
 echo "Setting up build environment"
 echo "CARGO_HOME = ${HOME}/${CARGO_HOME}"
 mkdir -p "${HOME}/${CARGO_HOME}"
diff --git a/README.md b/README.md
index ec1272f..cbef3cc 100644
--- a/README.md
+++ b/README.md
@@ -79,7 +79,7 @@ Behavioural notes:
 | `secrets.CI_SSH_PRIVATE_KEY` | `secrets.CRATE_REGISTRY_SSH_PRIVKEY` |
 | `secrets.registry_password` | `secrets.OCI_REGISTRY_PASSWORD` |
 | `REGISTRY_SNAPSHOTS/RELEASES/OSS` | `OCI_REGISTRY_SNAPSHOTS/RELEASES/OSS` |
-| `REGISTRY` | `OCI_REGISTRY` | 
+| `REGISTRY` | `OCI_REGISTRY` |
 
 ### Workflow: `.github/workflows/publish-crate.yml`
 #### Renamed inputs and secrets