fix: use ghcr

.github/workflows/publish-client-image.yml

@@ -1,7 +1,7 @@
 name: publish-client-image
 
-# Builds the redapricot Go client into a container image with ko and pushes it
-# to the configured registry. Triggers on version tags and manual dispatch.
+# Builds the redapricot Go client into a container image with ko and pushes it to
+# the GitHub Container Registry (ghcr.io). Triggers on version tags and manual dispatch.
 on:
   push:
     tags:
@@ -15,17 +15,11 @@ on:
 
 permissions:
   contents: read
-  packages: write # required only when KO_DOCKER_REPO is on ghcr.io
+  packages: write # lets the built-in GITHUB_TOKEN push packages to ghcr.io
 
 env:
-  # ─────────────────────────────────────────────────────────────────────────────
-  #  EDIT ME — the image repository to publish to: <registry>/<namespace>/<name>
-  #  examples:
-  #    ghcr.io/your-org/redapricot-client
-  #    docker.io/youruser/redapricot-client
-  #    registry.example.com/team/redapricot-client
-  # ─────────────────────────────────────────────────────────────────────────────
-  KO_DOCKER_REPO: git.sfclub.cc/cloud/redapricot-client
+  # Image repository on ghcr.io: ghcr.io/<owner>/<name> (must be lowercase).
+  KO_DOCKER_REPO: ghcr.io/saltedfishclub/redapricot-client
 
 jobs:
   publish:
@@ -40,27 +34,24 @@ jobs:
 
       - uses: ko-build/setup-ko@v0.9
 
-      - name: Derive registry host and image tags
+      - name: Derive image tags
         id: meta
         run: |
-          echo "registry=${KO_DOCKER_REPO%%/*}" >> "$GITHUB_OUTPUT"
           tags="${GITHUB_REF_NAME},sha-${GITHUB_SHA::7}"
           if [ -n "${{ github.event.inputs.tag }}" ]; then
             tags="${tags},${{ github.event.inputs.tag }}"
           fi
           echo "tags=${tags}" >> "$GITHUB_OUTPUT"
 
-      # Authenticate to the registry.
-      #  • ghcr.io: setup-ko already logs in with the built-in GITHUB_TOKEN, so you
-      #    may delete this step.
-      #  • any other registry: set the REGISTRY_USERNAME / REGISTRY_PASSWORD repo
-      #    secrets; the host is derived from KO_DOCKER_REPO above.
-      - name: Log in to the container registry
+      # Authenticate to ghcr.io with the workflow's built-in GITHUB_TOKEN — no repo
+      # secrets needed. ko reads the Docker credentials this step writes, so it
+      # pushes as the same authenticated user.
+      - name: Log in to ghcr.io
         uses: docker/login-action@v3
         with:
-          registry: ${{ steps.meta.outputs.registry }}
-          username: ${{ secrets.REGISTRY_USERNAME }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push image with ko
         run: |