Move publishing to organization namespace

.gitea/README.md

@@ -175,17 +175,18 @@ Kubernetes/SWS provides static hosting for the published Packwiz repositories.
 The publishing workflow runs [`scripts/build-site.sh`](../scripts/build-site.sh),
 which exports committed Git revisions into the documented URL layout, then
 builds the multi-architecture image
-`tea.ahmza.com/ahmza/mcpacks-site`.
+`tea.ahmza.com/ahmza.com/mcpacks-site`.
 
 The workflow finally commits that image's immutable OCI digest to
-`apps/mcpacks/deployment.yaml` in the `ahmza/k8s-starter-pack` repository.
+`apps/mcpacks/deployment.yaml` in the `ahmza.com/k8s-starter-pack` repository.
 Argo CD notices that commit and performs the rollout; the workflow does not
 hold Kubernetes credentials or change the cluster directly.
 
-The Gitea Actions repository secret `GITEATOKEN` must be able to:
+The Gitea Actions repository secret `GITEATOKEN` must belong to `ci-bot`
+and be able to:
 
-- push packages owned by `ahmza`
-- read and write `ahmza/k8s-starter-pack`
+- push packages owned by the `ahmza.com` organization
+- read and write `ahmza.com/k8s-starter-pack`
 
 The `latest` image tag exists only to bootstrap the first Argo CD sync and for
 human inspection. Normal rollouts use the exact content digest recorded in the

.gitea/workflows/publish.yml

@@ -15,7 +15,7 @@ concurrency:
 
 env:
   REGISTRY: tea.ahmza.com
-  IMAGE_NAME: ahmza/mcpacks-site
+  IMAGE_NAME: ahmza.com/mcpacks-site
 
 jobs:
   publish:
@@ -66,7 +66,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
-          username: ${{ gitea.repository_owner }}
+          username: ci-bot
           password: ${{ secrets.GITEATOKEN }}
 
       # The SWS runtime image already publishes amd64 and arm64 variants and
@@ -94,7 +94,7 @@ jobs:
       - name: Check out cluster GitOps repository
         uses: actions/checkout@v4
         with:
-          repository: ahmza/k8s-starter-pack
+          repository: ahmza.com/k8s-starter-pack
           ref: main
           token: ${{ secrets.GITEATOKEN }}
           path: _gitops
@@ -113,7 +113,7 @@ jobs:
           manifest = Path("_gitops/apps/mcpacks/deployment.yaml")
           image = sys.argv[1]
           prefix = "          image: "
-          repository = "tea.ahmza.com/ahmza/mcpacks-site"
+          repository = "tea.ahmza.com/ahmza.com/mcpacks-site"
           lines = manifest.read_text().splitlines()
           matches = [
               i for i, line in enumerate(lines)