API Gateway GHCR publish blocked by missing cross-repository credential

[man4ish]

Summary

The API Gateway GHCR publishing workflow is implemented and validated locally, but GitHub Actions cannot access the credential required to retrieve the private omnibioai-iam-client dependency.

Current status

• PR ci: add GHCR release workflow using the TES/RAG BuildKit-secret pattern #11: feature/api-gateway-ghcr-release
• Implementation: complete
• Local Docker BuildKit build: successful
• Local container /health: 200
• Workflow YAML: valid
• GHCR authentication: successful
• GitHub Actions workflow_dispatch: failed twice with the same signature
• Repository Actions secrets: confirmed empty
• IAM_CLIENT_READ_TOKEN: not available to the workflow
• No image has been published by the new workflow

Failure

The workflow references:

secrets.IAM_CLIENT_READ_TOKEN

but GitHub Actions resolves it to an empty value. BuildKit therefore receives no github_token secret and the Docker build fails when attempting to access the private omnibioai-iam-client repository.

Required action

An organization/repository administrator needs to provision the credential and make it available to omnibioai-api-gateway.

Recommended credential:

• Fine-grained PAT
• Repository access: omnibioai-iam-client only
• Permission: Contents: Read-only
• Actions secret name: IAM_CLIENT_READ_TOKEN
• If configured as an organization secret, explicitly include omnibioai-api-gateway in the repository access list

Security follow-up

A separate GHCR_PULL_TOKEN was accidentally exposed during an earlier diagnostic command and should be revoked/rotated independently.

Completion criteria

• IAM_CLIENT_READ_TOKEN is provisioned with least-privilege access
• Secret is accessible to omnibioai-api-gateway Actions
• workflow_dispatch completes successfully
• Private omnibioai-iam-client@v0.1.3 dependency is retrieved successfully
• API Gateway image is published to GHCR
• Published image starts successfully
• /health returns HTTP 200
• PR ci: add GHCR release workflow using the TES/RAG BuildKit-secret pattern #11 can be merged
• GHCR_PULL_TOKEN is rotated/revoked following the accidental disclosure