From 49cc7e0317a2ef40c88de81d4d323846d84af68e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 17 Mar 2026 22:08:42 +0000
Subject: [PATCH] fix: set ghcr.io package visibility to public after Docker
 push

Users pulling the image without authentication get "unauthorized" because
ghcr.io packages default to private under an organization. Add a step in
both release workflows to explicitly set the container package to public.

https://claude.ai/code/session_01QovQeW26KfEEmU1KdFfCPU
---
 .github/workflows/bump.yml    | 7 +++++++
 .github/workflows/release.yml | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml
index a6c4d5d..f180f53 100644
--- a/.github/workflows/bump.yml
+++ b/.github/workflows/bump.yml
@@ -90,6 +90,13 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Make package public
+        run: |
+          gh api orgs/${{ github.repository_owner }}/packages/container/crumbs -X PATCH \
+            -f visibility=public
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0b94658..c973252 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -50,6 +50,13 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Make package public
+        run: |
+          gh api orgs/${{ github.repository_owner }}/packages/container/crumbs -X PATCH \
+            -f visibility=public
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with: