fix(registry): block template image publishing

src/aio_fleet/cli.py

@@ -1112,6 +1112,12 @@ def cmd_registry_publish(args: argparse.Namespace) -> int:
     repo = _repo_for_identifier(manifest, args.repo)
     if args.repo_path:
         repo = _repo_with_path(repo, Path(args.repo_path).resolve())
+    if repo.publish_profile == "template":
+        print(
+            f"{repo.name}: registry publish is disabled for template-profile repos",
+            file=sys.stderr,
+        )
+        return 1
     sha = args.sha or _git_head(repo.path)
     command = registry_publish_command(repo, sha=sha, component=args.component)
     if args.dry_run:

src/aio_fleet/control_plane.py

@@ -69,6 +69,7 @@ def central_check_steps(
 ) -> list[Step]:
     manifest_args = ["--manifest", str(manifest_path)] if manifest_path else []
     trusted_cwd = _trusted_aio_root()
+    registry_publish_enabled = publish and repo.publish_profile != "template"
     steps = [
         Step(
             "validate-repo",
@@ -133,7 +134,7 @@ def central_check_steps(
         and event in {"pull_request", "push", "release", "workflow_dispatch"}
         and integration_args
     ):
-        if publish:
+        if registry_publish_enabled:
             steps.append(_pytest_image_build_step(repo))
             prebuilt_integration_image = True
         steps.append(
@@ -178,7 +179,7 @@ def central_check_steps(
                 inherit_secrets=False,
             )
         )
-    if publish:
+    if registry_publish_enabled:
         components = publish_components(repo)
         for component in components:
             step_name = (

tests/test_cli.py

@@ -776,6 +776,40 @@ def fake_run(
     )  # nosec B101
 
 
+def test_registry_publish_refuses_template_profile(tmp_path: Path, capsys) -> None:
+    repo_path = tmp_path / "repo"
+    repo_path.mkdir()
+    manifest = tmp_path / "fleet.yml"
+    manifest.write_text(f"""
+owner: JSONbored
+repos:
+  unraid-aio-template:
+    path: {repo_path}
+    app_slug: unraid-aio-template
+    image_name: jsonbored/unraid-aio-template
+    docker_cache_scope: unraid-aio-template-image
+    pytest_image_tag: unraid-aio-template:pytest
+    publish_profile: template
+""")
+
+    result = cmd_registry_publish(
+        Namespace(
+            manifest=str(manifest),
+            repo="unraid-aio-template",
+            repo_path=str(repo_path),
+            sha="a" * 40,
+            component="aio",
+            dry_run=False,
+        )
+    )
+
+    assert result == 1  # nosec B101
+    assert (
+        "unraid-aio-template: registry publish is disabled for template-profile repos"
+        in capsys.readouterr().err
+    )  # nosec B101
+
+
 def test_registry_publish_logs_in_with_temporary_scrubbed_docker_config(
     tmp_path: Path, monkeypatch
 ) -> None:

tests/test_control_plane.py

@@ -83,6 +83,17 @@ def test_central_check_steps_use_mem0_publish_timeout() -> None:
     assert publish.timeout_seconds == 7200  # nosec B101
 
 
+def test_central_check_steps_skip_template_registry_publish() -> None:
+    repo = load_manifest(ROOT / "fleet.yml").repo("unraid-aio-template")
+
+    steps = central_check_steps(repo, event="push", publish=True)
+
+    names = [step.name for step in steps]
+    assert "build-pytest-image" not in names  # nosec B101
+    assert not any(name.startswith("registry-publish") for name in names)  # nosec B101
+    assert "integration-tests" in names  # nosec B101
+
+
 def test_registry_publish_command_uses_plain_progress() -> None:
     repo = load_manifest(ROOT / "fleet.yml").repo("mem0-aio")