ci: use GHCR users API to list container versions

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Author: sisyphus-dev-ai

.github/workflows/check-upstream-release.yml

@@ -2,7 +2,6 @@ name: Check for Upstream Releases
 
 on:
   schedule:
-    # Check for new releases once a day at midnight UTC
     - cron: '0 0 * * *'
   workflow_dispatch:
     inputs:
@@ -16,6 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      packages: read
       actions: write
     outputs:
       should_build: ${{ steps.check.outputs.should_build }}
@@ -25,7 +25,6 @@ jobs:
       - name: Get latest release info from upstream
         id: upstream
         run: |
-          # Fetch latest release from anomalyco/opencode
           RELEASE_JSON=$(curl -s -H "Accept: application/vnd.github+json" \
             -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
             -H "X-GitHub-Api-Version: 2022-11-28" \
@@ -38,22 +37,21 @@ jobs:
       - name: Check if we need to build
         id: check
         run: |
-          # Fetch latest upstream version
           UPSTREAM_VERSION="${{ steps.upstream.outputs.version }}"
           
-          # Query workflow runs to find the last successful build with upstream version
-          RUNS_RESPONSE=$(curl -s -H "Accept: application/vnd.github+json" \
+          OWNER_LOWER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
+          PACKAGE_NAME=$(echo "${{ github.repository }}" | sed 's/.*\///' | tr '[:upper:]' '[:lower:]')
+          
+          TAGS_RESPONSE=$(curl -s -H "Accept: application/vnd.github+json" \
             -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
             -H "X-GitHub-Api-Version: 2022-11-28" \
-            "https://api.github.com/repos/${{ github.repository }}/actions/runs?status=success&per_page=5")
+            "https://api.github.com/users/$OWNER_LOWER/packages/container/$PACKAGE_NAME/versions?per_page=100")
           
-          # Find the most recent run that was triggered by upstream-release and has upstream_version
-          CURRENT_VERSION=$(echo "$RUNS_RESPONSE" | jq -r '.workflow_runs[] | select(.display_title? | contains("upstream")) | .inputs.upstream_version // empty' 2>/dev/null | head -1)
+          CURRENT_VERSION=$(echo "$TAGS_RESPONSE" | jq -r '.[].metadata.container.tags[]' 2>/dev/null | grep '^upstream-' | head -1 | sed 's/upstream-//')
           
           echo "Current built version: $CURRENT_VERSION"
           echo "Latest upstream version: $UPSTREAM_VERSION"
           
-          # For manual dispatch or if no previous version, always build
           if [ "${{ github.event.inputs.force_build }}" == "true" ] || [ -z "$CURRENT_VERSION" ]; then
             echo "should_build=true" >> $GITHUB_OUTPUT
             echo "new_version=$UPSTREAM_VERSION" >> $GITHUB_OUTPUT
@@ -62,7 +60,6 @@ jobs:
             exit 0
           fi
           
-          # Compare versions
           if [ "$CURRENT_VERSION" != "$UPSTREAM_VERSION" ]; then
             echo "should_build=true" >> $GITHUB_OUTPUT
             echo "new_version=$UPSTREAM_VERSION" >> $GITHUB_OUTPUT
@@ -88,8 +85,6 @@ jobs:
         with:
           script: |
             const workflowId = 'docker-build.yml';
-            
-            // Get the workflow run URL
             const response = await github.rest.actions.createWorkflowDispatch({
               owner: context.repo.owner,
               repo: context.repo.repo,
@@ -101,5 +96,4 @@ jobs:
                 previous_version: '${{ needs.check-release.outputs.old_version }}'
               }
             });
-            
             console.log('Triggered Docker build for version: ${{ needs.check-release.outputs.new_version }}');

.sisyphus/plans/fix-ghcr-api.md

@@ -0,0 +1,18 @@
+# Fix: GHCR API for listing container versions
+
+## Context
+User wants to check Docker image tags in their own GHCR repo. Previous attempts used wrong API endpoints.
+
+## Plan
+
+### Task 1: Fix GHCR API call
+
+**What to do**: Use correct GHCR API endpoint for user-owned packages
+- Endpoint: `GET /users/{owner}/packages/container/{package_name}/versions`
+- Add `packages: read` permission back
+
+**Files**: `.github/workflows/check-upstream-release.yml`
+
+**QA Scenarios**:
+- Verify API returns container version tags
+- Verify upstream-* tag is detected correctly