ci(docker): publish fork image to GHCR + fix registry releaser

Author: gloriouskilka

.github/workflows/docker-publish.yml

@@ -30,7 +30,7 @@ env:
 
 jobs:
   build:
-    runs-on: ubuntu-latest-xl
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write

.github/workflows/registry-releaser.yml

@@ -11,6 +11,7 @@ jobs:
     permissions:
       id-token: write  # Required for OIDC authentication
       contents: read
+      packages: read
 
     steps:
       - name: Checkout code
@@ -20,7 +21,7 @@ jobs:
         uses: actions/setup-go@v6
         with:
           go-version: "stable"
-        
+
       - name: Fetch tags
         run: |
           if [[ "${{ github.ref_type }}" != "tag" ]]; then
@@ -29,21 +30,30 @@ jobs:
             echo "Skipping tag fetch - already on tag ${{ github.ref_name }}"
           fi
 
+      - name: Log into GHCR
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Wait for Docker image
         run: |
           if [[ "${{ github.ref_type }}" == "tag" ]]; then
             TAG="${{ github.ref_name }}"
           else
             TAG=$(git tag --sort=-version:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n1)
           fi
-          IMAGE="ghcr.io/github/github-mcp-server:$TAG"
-          
+
+          REPO="${GITHUB_REPOSITORY,,}"
+          IMAGE="ghcr.io/${REPO}:$TAG"
+
           for i in {1..10}; do
             if docker manifest inspect "$IMAGE" &>/dev/null; then
-              echo "✅ Docker image ready: $TAG"
+              echo "✅ Docker image ready: $IMAGE"
               break
             fi
-            [ $i -eq 10 ] && { echo "❌ Timeout waiting for $TAG after 5 minutes"; exit 1; }
+            [ $i -eq 10 ] && { echo "❌ Timeout waiting for $IMAGE after 5 minutes"; exit 1; }
             echo "⏳ Waiting for Docker image ($i/10)..."
             sleep 30
           done
@@ -80,4 +90,4 @@ jobs:
         run: ./mcp-publisher login github-oidc
 
       - name: Publish to MCP Registry
-        run: ./mcp-publisher publish
+        run: ./mcp-publisher publish

docs/DOCKER_GHCR_FORK.md

@@ -0,0 +1,29 @@
+## Docker images for this fork (GHCR)
+
+This repository publishes Docker images to **GitHub Container Registry**.
+
+- **Image**: `ghcr.io/redorangesweater/github-mcp-server`
+- **Common tags**:
+  - **`main`**: latest build from `main`
+  - **`sha-<...>`**: immutable build tag for a specific commit
+  - **`vX.Y.Z`**: release tag builds
+  - **`latest`**: only for stable `vX.Y.Z` tags (no pre-releases)
+
+### Pull
+
+```bash
+docker pull ghcr.io/redorangesweater/github-mcp-server:main
+```
+
+### Run
+
+```bash
+docker run -i --rm \
+  -e GITHUB_PERSONAL_ACCESS_TOKEN=... \
+  ghcr.io/redorangesweater/github-mcp-server:main
+```
+
+### Notes
+
+- If you see `denied` errors while pulling, run `docker logout ghcr.io` and try again (stale credentials can override public access).
+- Package visibility is controlled under GitHub **Packages** settings for the org/repo.