From 01449cdb3f568dda35f7fb7ec2ce853ba59526da Mon Sep 17 00:00:00 2001
From: BoxBoxJason <contact@boxboxjason.dev>
Date: Sat, 11 Apr 2026 04:03:11 +0200
Subject: [PATCH] feat: publish to ghcr.io in default config

Signed-off-by: BoxBoxJason <contact@boxboxjason.dev>
---
 .github/workflows/ci.yml | 28 +++++++++++++++++++++-------
 Makefile                 |  4 ++--
 2 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9320ead..04d1d89 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,14 +5,20 @@ on:
     branches:
       - main
       - release-*
+    tags:
+      - v*
   pull_request: {}
   workflow_dispatch: {}
 
+permissions:
+  contents: read
+  packages: write
+
 env:
   # Common versions
-  GO_VERSION: '1.23'
-  GOLANGCI_VERSION: 'v2.1.2'
-  DOCKER_BUILDX_VERSION: 'v0.23.0'
+  GO_VERSION: "1.23"
+  GOLANGCI_VERSION: "v2.1.2"
+  DOCKER_BUILDX_VERSION: "v0.23.0"
 
   # Common users. We can't run a step 'if secrets.XXX != ""' but we can run a
   # step 'if env.XXX' != ""', so we copy these to succinctly test whether
@@ -32,7 +38,6 @@ jobs:
           paths_ignore: '["**.md", "**.png", "**.jpg"]'
           do_not_skip: '["workflow_dispatch", "schedule", "push"]'
 
-
   lint:
     runs-on: ubuntu-22.04
     needs: detect-noop
@@ -190,8 +195,15 @@ jobs:
           version: ${{ env.DOCKER_BUILDX_VERSION }}
           install: true
 
+      - name: Login to GHCR
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Login to Upbound
-        uses: docker/login-action@v1
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         if: env.UPBOUND_MARKETPLACE_PUSH_ROBOT_USR != ''
         with:
           registry: xpkg.upbound.io
@@ -246,5 +258,7 @@ jobs:
           path: _output/**
 
       - name: Publish Artifacts
-        if: env.UPBOUND_MARKETPLACE_PUSH_ROBOT_USR != ''
-        run: make publish BRANCH_NAME=${GITHUB_REF##*/}
+        if: github.event_name != 'pull_request'
+        env:
+          XPKG_REG_ORGS: ${{ env.UPBOUND_MARKETPLACE_PUSH_ROBOT_USR != '' && 'xpkg.upbound.io/crossplane-contrib ghcr.io/crossplane-contrib' || 'ghcr.io/crossplane-contrib' }}
+        run: make publish BRANCH_NAME=${GITHUB_REF##*/} RELEASE_BRANCH_FILTER='main master release-% v%'
diff --git a/Makefile b/Makefile
index 01874de..1f956cf 100644
--- a/Makefile
+++ b/Makefile
@@ -37,10 +37,10 @@ IMAGES = provider-template
 # ====================================================================================
 # Setup XPKG
 
-XPKG_REG_ORGS ?= xpkg.upbound.io/crossplane
+XPKG_REG_ORGS ?= xpkg.upbound.io/crossplane ghcr.io/crossplane-contrib
 # NOTE(hasheddan): skip promoting on xpkg.upbound.io as channel tags are
 # inferred.
-XPKG_REG_ORGS_NO_PROMOTE ?= xpkg.upbound.io/crossplane
+XPKG_REG_ORGS_NO_PROMOTE ?= xpkg.upbound.io/crossplane ghcr.io/crossplane-contrib
 XPKGS = provider-template
 -include build/makelib/xpkg.mk