From 726d877d17994eea87df537d0fb35b4b6b910c85 Mon Sep 17 00:00:00 2001
From: Johannes Millan <johannesjo@users.noreply.github.com>
Date: Mon, 1 Jun 2026 13:32:06 +0200
Subject: [PATCH] fix(sync): point manual supersync image push at
 super-productivity org (#7871)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

build-and-push.sh defaulted the image namespace to the deprecated ghcr.io/johannesjo/supersync — the source of the stale 7-day-token :latest image in #7865. Default to the super-productivity org instead, matching the CI workflow, docker-compose.yml and the Helm chart.

Since you cannot docker login as an org, split the image namespace (GHCR_NAMESPACE, defaulting to the org) from the GHCR login account (GHCR_USER), and fail fast if a push is attempted with no GHCR_USER set.

Refs #7865
---
 .../scripts/build-and-push.sh                 | 21 +++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/packages/super-sync-server/scripts/build-and-push.sh b/packages/super-sync-server/scripts/build-and-push.sh
index 40ae5aeef8..0ff9362635 100755
--- a/packages/super-sync-server/scripts/build-and-push.sh
+++ b/packages/super-sync-server/scripts/build-and-push.sh
@@ -12,8 +12,10 @@
 #
 # Prerequisites:
 #   Add to .env file:
-#     GHCR_USER=your-github-username
+#     GHCR_USER=your-github-username   # GitHub account used to log in to GHCR
 #     GHCR_TOKEN=your-github-token
+#   Optional:
+#     GHCR_NAMESPACE=super-productivity  # image owner; defaults to the org
 
 set -e
 
@@ -25,13 +27,19 @@ DOCKERFILE="$SERVER_DIR/Dockerfile"
 
 # Load .env file
 if [ -f "$SERVER_DIR/.env" ]; then
-    export $(grep -E '^(GHCR_USER|GHCR_TOKEN)=' "$SERVER_DIR/.env" | xargs)
+    export $(grep -E '^(GHCR_USER|GHCR_TOKEN|GHCR_NAMESPACE)=' "$SERVER_DIR/.env" | xargs)
 fi
 
 # Configuration
-GITHUB_USER="${GHCR_USER:-johannesjo}"
+# Publish under the super-productivity org namespace to match the CI workflow
+# (.github/workflows/supersync-docker.yml), docker-compose.yml and the Helm
+# chart. Override GHCR_NAMESPACE only when pushing to a fork/personal registry.
+GHCR_NAMESPACE="${GHCR_NAMESPACE:-super-productivity}"
+# GHCR login user: a GitHub *account* with write access to the namespace's
+# packages (you cannot authenticate as an org). Required only when pushing.
+GITHUB_USER="${GHCR_USER:-}"
 GHCR_TOKEN="${GHCR_TOKEN:-}"
-IMAGE_NAME="ghcr.io/$GITHUB_USER/supersync"
+IMAGE_NAME="ghcr.io/$GHCR_NAMESPACE/supersync"
 
 supersync_image_source_revision() {
     git -C "$REPO_ROOT" log -1 --format=%H -- \
@@ -135,6 +143,11 @@ echo ""
 
 # Step 2: Login to GHCR (if token provided)
 if [ -n "$GHCR_TOKEN" ]; then
+    if [ -z "$GITHUB_USER" ]; then
+        echo "ERROR: GHCR_TOKEN is set but GHCR_USER is empty." >&2
+        echo "       Set GHCR_USER to the GitHub account used to authenticate to GHCR." >&2
+        exit 1
+    fi
     echo "==> Logging in to GHCR..."
     echo "$GHCR_TOKEN" | docker login ghcr.io -u "$GITHUB_USER" --password-stdin
     echo ""