build(miner): pin tip GHCR digests and publicize packages

Point DEFAULT agent and attest-helper images at images CI tip
3056ca7 digests. Add a workflow that sets those GHCR packages
public so Phala CVMs can pull without registry credentials.

Author: echobt

.github/workflows/ghcr-public.yml

@@ -0,0 +1,54 @@
+# Make GHCR container packages public so paid Phala / unauth pulls work.
+# GITHUB_TOKEN has packages:write in this workflow; account PATs often lack it.
+name: ghcr-public
+
+on:
+  workflow_dispatch:
+  workflow_run:
+    workflows: ["images"]
+    types: [completed]
+    branches: [reborn, dev]
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  set-public:
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set package visibility public
+        env:
+          GH_TOKEN: ${{ github.token }}
+          OWNER: ${{ github.repository_owner }}
+        run: |
+          set -euo pipefail
+          # Nested image names: ghcr.io/<owner>/gbase/<suffix> → package name "gbase/<suffix>"
+          pkgs=(
+            "gbase/gbase-agent"
+            "gbase/gbase-attest-helper"
+            "gbase/gateway"
+            "gbase/validator"
+            "gbase/updater"
+            "gbase/agent-challenge"
+          )
+          ok=0
+          for pkg in "${pkgs[@]}"; do
+            enc=$(python3 -c 'import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1], safe=""))' "$pkg")
+            code=$(curl -sS -o "/tmp/vis-${enc}.json" -w "%{http_code}" \
+              -X PUT \
+              -H "Accept: application/vnd.github+json" \
+              -H "Authorization: Bearer ${GH_TOKEN}" \
+              -H "X-GitHub-Api-Version: 2022-11-28" \
+              "https://api.github.com/orgs/${OWNER}/packages/container/${enc}/visibility" \
+              -d '{"visibility":"public"}' || true)
+            echo "pkg=${pkg} http=${code} body=$(head -c 200 /tmp/vis-${enc}.json || true)"
+            if [ "$code" = "204" ] || [ "$code" = "200" ]; then
+              ok=$((ok + 1))
+            fi
+          done
+          echo "publicized_ok=${ok}/${#pkgs[@]}"
+          test "$ok" -ge 1

crates/miner/src/deploy.rs

@@ -11,12 +11,12 @@ use crate::inspect::reject_raw_docker_sock_on_agent;
 pub use crate::template::DEFAULT_SOCKET_PROXY_IMAGE;
 use crate::template::{docker_compose_yaml, ComposeTemplateInput, DOCKER_BASE_ENV};
 
-/// Default digest-pinned agent image (placeholder pin until CI publishes real digests).
+/// Default digest-pinned agent image (digest from images CI tip 3056ca7).
 pub const DEFAULT_AGENT_IMAGE: &str =
-    "ghcr.io/baseintelligence/gbase/gbase-agent@sha256:c4cd56307195c50aab92c4b162c603dbca080061f86c5b9886c0e3c61cf7285f";
+    "ghcr.io/baseintelligence/gbase/gbase-agent@sha256:50508825f450c6d1b21e53bf61cda8eeee6373eaced24ec3925555feac3ebc83";
 /// Default digest-pinned attest-helper image.
 pub const DEFAULT_ATTEST_HELPER_IMAGE: &str =
-    "ghcr.io/baseintelligence/gbase/gbase-attest-helper@sha256:783582207b46ec19ff9a8568d922125e2b6ad6049b493903107746b326289cd2";
+    "ghcr.io/baseintelligence/gbase/gbase-attest-helper@sha256:9bf28955414f087d27e033e085a16be2fda20290404add83bd919893c24e8d7c";
 
 /// Whether to invoke the Phala CLI after rendering.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]