From cb7661dde68f0d5911ca2592d31b89f83821b37b Mon Sep 17 00:00:00 2001
From: Inferencebot <info@inference.coop>
Date: Mon, 26 Oct 2026 02:13:28 +0000
Subject: [PATCH] release.sh: also accept a registry app password from the env

REGISTRY_BUILD_TOKEN (+ optional REGISTRY_BUILD_USERNAME) lets a build run from
any host with the token in its environment, no ~/.cloudron.json builder config
required. The narrow credential (app password scoped to the registry app) is the
least-privileged way to hand a host build rights; with no token and no builder
config the script prints both bootstrap routes and exits instead of guessing.
---
 release.sh | 41 ++++++++++++++++++++++++++---------------
 1 file changed, 26 insertions(+), 15 deletions(-)

diff --git a/release.sh b/release.sh
index 4b63cac..56e3130 100755
--- a/release.sh
+++ b/release.sh
@@ -39,30 +39,41 @@ cr() { cloudron --server "$SERVER" --token "$CLOUDRON_TOKEN" "$@"; }
 manifest_tag() { python3 -c "import json;print(json.load(open('$MANIFEST'))['dockerImage'].rsplit(':',1)[-1])"; }
 
 cmd_build() {
-  # Builds are REMOTE: the CLI uploads the build context and the registry's
+  # Builds are REMOTE: the CLI uploads the build context and the registry app's
   # BuildKit does the work (no docker on the caller). What is required is a
-  # registry login for this user on this host — see the check below.
+  # registry login for this user on this host — env token or builder config.
   local tag="${TAG:-$(date -u +%Y%m%d)-$(git rev-parse --short HEAD)}"
   [ -z "$(git status --porcelain)" ] || die "working tree is dirty — commit first, the tag carries the git sha"
-  if ! cloudron builder info >/dev/null 2>&1; then
-    die "no registry build config on this host (this is the only blocker to ./release.sh build)"
-  fi
-  if grep -qi "not logged in" <<<"$(cloudron builder info 2>&1 || true)"; then
+
+  local logged_in=0
+  if cloudron builder info 2>/dev/null | grep -viq "not logged in"; then logged_in=1; fi
+
+  local authargs=()
+  if [ -n "${REGISTRY_BUILD_TOKEN:-}" ]; then
+    # Narrow path: a credential scoped to the registry app only, kept in the
+    # caller's env — nothing is written to disk here.
+    authargs=(--registry-url https://registry.inference.coop
+              --registry-username "${REGISTRY_BUILD_USERNAME:-registry-bot}"
+              --registry-password "$REGISTRY_BUILD_TOKEN")
+  elif [ "$logged_in" = 1 ]; then
+    authargs=()   # builder config in ~/.cloudron.json is enough
+  else
     cat >&2 <<'MSG'
 release.sh: this host has no registry login, so it cannot start a remote build.
-  Bootstrap it one of two ways:
-    a) narrow: in the Cloudron dashboard, mint an app password for registry-bot
-       scoped to the registry app (c257ba3c-6737-4375-ad51-ea19586bf3f0), put it on
-       this host, then write into ~/.cloudron.json:
-       {"builder": {"kind":"registry","type":"remote","url":"https://registry.inference.coop",
-                    "username":"registry-bot","token":"<app password>"}}
-    b) broad: `cloudron login my.inference.coop` (device flow — a human with
-       dashboard access confirms a code), then `cloudron builder login`.
+  Bootstrap one of two ways:
+    a) narrow: mint an app password in the dashboard as `registry-bot`, scoped to
+       the registry app id (c257ba3c-6737-4375-ad51-ea19586bf3f0), then on this host
+       put REGISTRY_BUILD_TOKEN=<app password> into the environment
+       (e.g. append it to ~/.hermes/.env). Nothing else to configure.
+    b) broad: `cloudron login my.inference.coop` runs a device flow — a human with
+       dashboard access confirms a code — then `cloudron builder login`. This
+       grants a full CLI session, not just build rights.
 MSG
     exit 1
   fi
+
   printf 'building %s:%s (base %s)\n' "$REGISTRY_REPO" "$tag" "$BASE_IMAGE"
-  cloudron builder build --no-cache --repository "$REGISTRY_REPO" --tag "$tag" || die "build failed"
+  cloudron builder "${authargs[@]}" build --no-cache --repository "$REGISTRY_REPO" --tag "$tag" || die "build failed"
   printf '\nbuilt tag: %s\nnext: ./release.sh pin %s\n' "$tag" "$tag"
 }