From ebf075be265cddd605ec6ca89fef0d9ff036972f Mon Sep 17 00:00:00 2001
From: sergiomaldo <206754515+sergiomaldo@users.noreply.github.com>
Date: Fri, 21 Aug 2026 10:06:05 -0400
Subject: [PATCH] fix(release): let a fork publish and consume its own images
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two hard-coded references to `legalquants` make a fork of this repo
unable to build or run itself, which matters most in exactly the
situation forks exist for: carrying a patch while it is in review here.

`release.yml` pinned `NAMESPACE: legalquants`. A fork's workflow run
authenticates as the fork owner, then tries to push to a namespace it
has no write access to, and fails at the first push. The workaround is
to edit the workflow, which then shows up as a diff in every PR that
fork sends back. `github.repository_owner` resolves to `legalquants`
here, so upstream behaviour is unchanged.

`docker-compose.release.yml` hard-coded the pull namespace, so someone
following the documented install against a fork silently got upstream's
images — the stack comes up healthy and runs code the operator did not
intend, which is worse than failing. It is now
`${DONNA_IMAGE_NAMESPACE:-legalquants}`, documented in `.env.example`,
with the same default.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .env.example                  |  3 +++
 .github/workflows/release.yml | 12 +++++++++++-
 docker-compose.release.yml    | 12 +++++++-----
 3 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/.env.example b/.env.example
index 9bd9cbd3..f9bcf9b8 100644
--- a/.env.example
+++ b/.env.example
@@ -17,6 +17,9 @@ DONNA_WEB_HOST_PORT=13002    # Donna's frontend
 # --- Pre-built image tag (docker-compose.release.yml only; ignored by the
 #     build-from-source compose). Default 'latest'; pin to a release, e.g. v0.1.0. ---
 DONNA_IMAGE_TAG=latest
+# GHCR namespace the release images are pulled from. Change this to run a fork's
+# build — e.g. DONNA_IMAGE_NAMESPACE=someone while their patch is in review.
+DONNA_IMAGE_NAMESPACE=legalquants
 
 # adapter-node Origin check — MUST equal the host URL the browser uses for donna-web.
 ORIGIN=http://localhost:13002
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f5c326b5..773850bd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,17 @@ permissions:
 
 env:
   REGISTRY: ghcr.io
-  NAMESPACE: legalquants
+  # Publish under whoever owns the repository the workflow is running in.
+  # Hard-coding `legalquants` meant a fork could never publish its own images:
+  # the run authenticates as the fork owner, then tries to push to a namespace
+  # it has no write access to, and fails at the first push. Anyone maintaining
+  # a fork — to carry a patch while it is in review, or to run a modified
+  # build — has to edit this file to do so, which then shows up as a diff in
+  # every PR they send back.
+  #
+  # `github.repository_owner` resolves to `legalquants` for this repo, so
+  # upstream behaviour is unchanged.
+  NAMESPACE: ${{ github.repository_owner }}
   PLATFORMS: linux/amd64,linux/arm64
 
 jobs:
diff --git a/docker-compose.release.yml b/docker-compose.release.yml
index 18a547ba..62ae7172 100644
--- a/docker-compose.release.yml
+++ b/docker-compose.release.yml
@@ -7,6 +7,8 @@
 #   docker compose -f docker-compose.release.yml up -d
 #
 # Images are published from github.com/LegalQuants/Donna to ghcr.io/legalquants.
+# Set DONNA_IMAGE_NAMESPACE in .env to pull a fork's images instead — e.g. while a
+# patch is in review upstream. The default is unchanged.
 # This file is a hand-maintained mirror of vendor/lq-ai/docker-compose.yml +
 # the donna-web service; re-sync it when the lq-ai pin bumps. (See CLAUDE.md.)
 # NOTE: lq-ai's own `web` (OpenWebUI) service is intentionally omitted here —
@@ -69,7 +71,7 @@ services:
       retries: 6
 
   gateway:
-    image: ghcr.io/legalquants/donna-gateway:${DONNA_IMAGE_TAG:-latest}
+    image: ghcr.io/${DONNA_IMAGE_NAMESPACE:-legalquants}/donna-gateway:${DONNA_IMAGE_TAG:-latest}
     restart: unless-stopped
     depends_on:
       postgres:
@@ -122,7 +124,7 @@ services:
       retries: 10
 
   api:
-    image: ghcr.io/legalquants/donna-api:${DONNA_IMAGE_TAG:-latest}
+    image: ghcr.io/${DONNA_IMAGE_NAMESPACE:-legalquants}/donna-api:${DONNA_IMAGE_TAG:-latest}
     restart: unless-stopped
     depends_on:
       postgres:
@@ -169,7 +171,7 @@ services:
       retries: 10
 
   ingest-worker:
-    image: ghcr.io/legalquants/donna-api:${DONNA_IMAGE_TAG:-latest}
+    image: ghcr.io/${DONNA_IMAGE_NAMESPACE:-legalquants}/donna-api:${DONNA_IMAGE_TAG:-latest}
     restart: unless-stopped
     depends_on:
       postgres:
@@ -214,7 +216,7 @@ services:
       retries: 6
 
   arq-worker:
-    image: ghcr.io/legalquants/donna-api:${DONNA_IMAGE_TAG:-latest}
+    image: ghcr.io/${DONNA_IMAGE_NAMESPACE:-legalquants}/donna-api:${DONNA_IMAGE_TAG:-latest}
     restart: unless-stopped
     depends_on:
       postgres:
@@ -245,7 +247,7 @@ services:
       retries: 6
 
   donna-web:
-    image: ghcr.io/legalquants/donna-web:${DONNA_IMAGE_TAG:-latest}
+    image: ghcr.io/${DONNA_IMAGE_NAMESPACE:-legalquants}/donna-web:${DONNA_IMAGE_TAG:-latest}
     restart: unless-stopped
     depends_on:
       api: