From eaa7139467005049591d24d2f85d221369db0f70 Mon Sep 17 00:00:00 2001
From: Frikky <frikky@shuffler.io>
Date: Sun, 10 May 2026 15:39:18 +0200
Subject: [PATCH 01/25] Change GITHUB_TOKEN to GH_TOKEN in workflow

---
 .github/workflows/release_binaries.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release_binaries.yml b/.github/workflows/release_binaries.yml
index 9975acb..1991ee5 100644
--- a/.github/workflows/release_binaries.yml
+++ b/.github/workflows/release_binaries.yml
@@ -79,5 +79,5 @@ jobs:
           tag_name: ${{ github.event.inputs.version }}
           files: dist/*
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
 

From ff1cd21bba2afcd3a9e78d175f405eb0a2c73e03 Mon Sep 17 00:00:00 2001
From: Frikky <frikky@shuffler.io>
Date: Sun, 10 May 2026 15:44:28 +0200
Subject: [PATCH 02/25] Fix environment variable usage in release workflow

---
 .github/workflows/release_binaries.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/release_binaries.yml b/.github/workflows/release_binaries.yml
index 1991ee5..db3c2cb 100644
--- a/.github/workflows/release_binaries.yml
+++ b/.github/workflows/release_binaries.yml
@@ -78,6 +78,5 @@ jobs:
         with:
           tag_name: ${{ github.event.inputs.version }}
           files: dist/*
-        env:
-          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
+          token: ${{ secrets.GH_TOKEN }}
 

From 05895a7cc66a15c36afc97c0c1df95d98fe3de97 Mon Sep 17 00:00:00 2001
From: Frikky <frikky@shuffler.io>
Date: Sun, 10 May 2026 15:45:19 +0200
Subject: [PATCH 03/25] Update release workflow for Go binaries

---
 .github/workflows/release_binaries.yml | 69 ++++++++++++++++++--------
 1 file changed, 48 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/release_binaries.yml b/.github/workflows/release_binaries.yml
index db3c2cb..bbf9ce1 100644
--- a/.github/workflows/release_binaries.yml
+++ b/.github/workflows/release_binaries.yml
@@ -4,66 +4,94 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'Version of the release (e.g. v0.3.6)'
+        description: "Version (e.g. v0.3.6)"
         required: true
 
+permissions:
+  contents: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
+
     strategy:
       matrix:
         os: [linux, darwin, windows]
         arch: [amd64, arm64]
+
     steps:
       - name: Checkout source
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
           go-version: "1.24"
 
-      - name: Set version
-        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
-
       - name: Build binary
         run: |
           mkdir -p dist
-          export GOOS=${{ matrix.os }}
-          export GOARCH=${{ matrix.arch }}
+
+          GOOS=${{ matrix.os }}
+          GOARCH=${{ matrix.arch }}
+
           EXT=""
           LDFLAGS=""
-      
+
           if [ "$GOOS" = "windows" ]; then
             EXT=".exe"
             LDFLAGS="-H=windowsgui"
           fi
-      
-          BINARY_NAME=orborus-agent-${GOOS}-${GOARCH}
-          OUTPUT=dist/$BINARY_NAME$EXT
-      
+
+          BINARY_NAME="orborus-agent-${GOOS}-${GOARCH}"
+          OUTPUT="dist/${BINARY_NAME}${EXT}"
+
           echo "Building $OUTPUT"
-          GOOS=$GOOS GOARCH=$GOARCH go build -ldflags="$LDFLAGS" -o $OUTPUT
+          GOOS=$GOOS GOARCH=$GOARCH go build -ldflags="$LDFLAGS" -o "$OUTPUT"
+
       - name: Package
         run: |
           cd dist
-          FILENAME=orborus-agent-${{ matrix.os }}-${{ matrix.arch }}
-          if [ "${{ matrix.os }}" = "windows" ]; then
-            zip $FILENAME.zip $FILENAME.exe
-          else
-            tar -czf $FILENAME.tar.gz $FILENAME
-          fi
 
-      - name: Upload build artifact
+          VERSION="${{ github.event.inputs.version }}"
+
+          for file in *; do
+            if [[ "$file" == *.exe ]]; then
+              zip "${file%.exe}.zip" "$file"
+            else
+              tar -czf "${file}.tar.gz" "$file"
+            fi
+          done
+
+      - name: Upload build artifacts
         uses: actions/upload-artifact@v4
         with:
           name: binaries-${{ matrix.os }}-${{ matrix.arch }}
           path: dist/*
 
+
   release:
     needs: build
     runs-on: ubuntu-latest
+
     steps:
+      - name: Checkout source (for tag creation)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Create and push git tag
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+
+          git config user.name "github-actions"
+          git config user.email "github-actions@github.com"
+
+          git tag "$VERSION"
+          git push origin "$VERSION"
+
       - name: Download artifacts
         uses: actions/download-artifact@v4
         with:
@@ -73,10 +101,9 @@ jobs:
         run: |
           find dist -mindepth 2 -type f -exec mv -t dist {} + || true
 
-      - name: Upload binaries to GitHub Release
+      - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ github.event.inputs.version }}
           files: dist/*
           token: ${{ secrets.GH_TOKEN }}
-

From 8b376f07eb481b9e5612c47d428b041c4d2aec97 Mon Sep 17 00:00:00 2001
From: Aditya <60684641+0x0elliot@users.noreply.github.com>
Date: Tue, 12 May 2026 16:17:56 +0530
Subject: [PATCH 04/25] ci: add Docker release workflow for tagged images and
 latest builds

---
 .github/workflows/docker-release.yml | 112 +++++++++++++++++++++++++++
 1 file changed, 112 insertions(+)
 create mode 100644 .github/workflows/docker-release.yml

diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
new file mode 100644
index 0000000..8142ef7
--- /dev/null
+++ b/.github/workflows/docker-release.yml
@@ -0,0 +1,112 @@
+name: Docker Release & Latest
+
+on:
+  release:
+    types: [published]
+  push:
+    branches:
+      - main
+    paths:
+      - "**"
+      - "!.github/**"
+      - "!**.md"
+      - "!docker-compose.yml"
+  workflow_dispatch:
+    inputs:
+      build_type:
+        description: "Build type"
+        required: true
+        default: "latest"
+        type: choice
+        options:
+          - latest
+          - release
+          - both
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build_and_push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: "amd64,arm64,arm"
+
+      - name: Login to DockerHub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Login to Ghcr
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Determine build type and version
+        id: version
+        run: |
+          if [[ "${{ github.event_name }}" == "release" ]]; then
+            VERSION="${{ github.event.release.tag_name }}"
+            BUILD_TYPE="release"
+          elif [[ "${{ github.event_name }}" == "push" ]]; then
+            VERSION="latest"
+            BUILD_TYPE="latest"
+          else
+            BUILD_TYPE="${{ github.event.inputs.build_type }}"
+            VERSION="${{ github.event.inputs.version || 'latest' }}"
+          fi
+
+          echo "build_type=${BUILD_TYPE}" >> $GITHUB_OUTPUT
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+
+          # Strip 'v' prefix if present
+          STRIPPED_VERSION=$(echo "${VERSION}" | sed 's/^v//')
+          echo "stripped_version=${STRIPPED_VERSION}" >> $GITHUB_OUTPUT
+          echo "Version: ${VERSION}, Stripped: ${STRIPPED_VERSION}, Type: ${BUILD_TYPE}"
+
+      - name: Build and push (latest)
+        if: steps.version.outputs.build_type == 'latest' || steps.version.outputs.build_type == 'both'
+        uses: docker/build-push-action@v5
+        with:
+          context: ./
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: |
+            ghcr.io/shuffle/shuffle-orborus:latest
+            ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:latest
+            frikky/shuffle-orborus:latest
+            frikky/shuffle:orborus
+
+      - name: Build and push (release with aliases)
+        if: steps.version.outputs.build_type == 'release' || steps.version.outputs.build_type == 'both'
+        uses: docker/build-push-action@v5
+        with:
+          context: ./
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: |
+            ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.version }}
+            ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
+            ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:${{ steps.version.outputs.version }}
+            ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
+            frikky/shuffle-orborus:${{ steps.version.outputs.version }}
+            frikky/shuffle-orborus:${{ steps.version.outputs.stripped_version }}

From 3ca05704eab5214f6d96aa957b031924cc5404b1 Mon Sep 17 00:00:00 2001
From: Aditya <60684641+0x0elliot@users.noreply.github.com>
Date: Tue, 12 May 2026 16:23:53 +0530
Subject: [PATCH 05/25] ci: add Docker release workflow for tagged images and
 latest builds

---
 .github/workflows/docker-release.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index 8142ef7..28ce91c 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -110,3 +110,12 @@ jobs:
             ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
             frikky/shuffle-orborus:${{ steps.version.outputs.version }}
             frikky/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
+
+      - name: Push tag to shuffle-orborus
+        if: steps.version.outputs.build_type == 'release' || steps.version.outputs.build_type == 'both'
+        run: |
+          git config --global user.name "github-actions"
+          git config --global user.email "github-actions@github.com"
+
+          git remote add shuffle-orborus https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/shuffle/shuffle-orborus.git
+          git push shuffle-orborus ${{ steps.version.outputs.version }}

From be13699ac275516758a90f39dead8297423067c9 Mon Sep 17 00:00:00 2001
From: Aditya <60684641+0x0elliot@users.noreply.github.com>
Date: Tue, 12 May 2026 16:28:16 +0530
Subject: [PATCH 06/25] ci: add shuffle-orborus registry tags to all Docker
 build workflows

---
 .github/workflows/docker-release.yml      | 15 ++++++---------
 .github/workflows/dockerbuild-nightly.yml |  2 ++
 .github/workflows/dockerbuild.yml         |  2 ++
 3 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index 28ce91c..7937660 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -89,7 +89,9 @@ jobs:
           cache-to: type=gha,mode=max
           tags: |
             ghcr.io/shuffle/shuffle-orborus:latest
+            ghcr.io/shuffle-orborus/shuffle-orborus:latest
             ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:latest
+            shuffle-orborus/shuffle-orborus:latest
             frikky/shuffle-orborus:latest
             frikky/shuffle:orborus
 
@@ -106,16 +108,11 @@ jobs:
           tags: |
             ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.version }}
             ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
+            ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.version }}
+            ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
             ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:${{ steps.version.outputs.version }}
             ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
+            shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.version }}
+            shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
             frikky/shuffle-orborus:${{ steps.version.outputs.version }}
             frikky/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
-
-      - name: Push tag to shuffle-orborus
-        if: steps.version.outputs.build_type == 'release' || steps.version.outputs.build_type == 'both'
-        run: |
-          git config --global user.name "github-actions"
-          git config --global user.email "github-actions@github.com"
-
-          git remote add shuffle-orborus https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/shuffle/shuffle-orborus.git
-          git push shuffle-orborus ${{ steps.version.outputs.version }}
diff --git a/.github/workflows/dockerbuild-nightly.yml b/.github/workflows/dockerbuild-nightly.yml
index c7fa3cd..7137370 100644
--- a/.github/workflows/dockerbuild-nightly.yml
+++ b/.github/workflows/dockerbuild-nightly.yml
@@ -63,7 +63,9 @@ jobs:
           cache-to: type=gha,mode=max
           tags: |
             ghcr.io/shuffle/${{ matrix.app }}:${{ matrix.version }}
+            ghcr.io/shuffle-orborus/shuffle-${{ matrix.app }}:${{ matrix.version }}
             ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-${{ matrix.app }}:${{ matrix.version }}
+            shuffle-orborus/shuffle-${{ matrix.app }}:${{ matrix.version }}
             frikky/shuffle-${{ matrix.app }}:${{ matrix.version }}
             frikky/shuffle:${{ matrix.app }}
 
diff --git a/.github/workflows/dockerbuild.yml b/.github/workflows/dockerbuild.yml
index 492c040..0e7734f 100644
--- a/.github/workflows/dockerbuild.yml
+++ b/.github/workflows/dockerbuild.yml
@@ -63,7 +63,9 @@ jobs:
           cache-to: type=gha,mode=max
           tags: |
             ghcr.io/shuffle/shuffle-${{ matrix.app }}:${{ matrix.version }}
+            ghcr.io/shuffle-orborus/shuffle-${{ matrix.app }}:${{ matrix.version }}
             ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-${{ matrix.app }}:${{ matrix.version }}
+            shuffle-orborus/shuffle-${{ matrix.app }}:${{ matrix.version }}
             frikky/shuffle-${{ matrix.app }}:${{ matrix.version }}
             frikky/shuffle:${{ matrix.app }}
 

From da2e2c42d7f8dba64b94cc4b7d94d2664dc19366 Mon Sep 17 00:00:00 2001
From: Aditya <60684641+0x0elliot@users.noreply.github.com>
Date: Tue, 12 May 2026 16:30:38 +0530
Subject: [PATCH 07/25] Replace GITHUB_TOKEN with GH_TOKEN in all Docker
 workflows

---
 .github/workflows/docker-release.yml      | 4 ++--
 .github/workflows/dockerbuild-nightly.yml | 2 +-
 .github/workflows/dockerbuild.yml         | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index 7937660..7a34e8d 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -53,7 +53,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.GH_TOKEN }}
 
       - name: Determine build type and version
         id: version
@@ -66,7 +66,7 @@ jobs:
             BUILD_TYPE="latest"
           else
             BUILD_TYPE="${{ github.event.inputs.build_type }}"
-            VERSION="${{ github.event.inputs.version || 'latest' }}"
+            VERSION="latest"
           fi
 
           echo "build_type=${BUILD_TYPE}" >> $GITHUB_OUTPUT
diff --git a/.github/workflows/dockerbuild-nightly.yml b/.github/workflows/dockerbuild-nightly.yml
index 7137370..b13a48f 100644
--- a/.github/workflows/dockerbuild-nightly.yml
+++ b/.github/workflows/dockerbuild-nightly.yml
@@ -49,7 +49,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.GH_TOKEN }}
 
       - name: Ghcr Build and push
         id: docker_build
diff --git a/.github/workflows/dockerbuild.yml b/.github/workflows/dockerbuild.yml
index 0e7734f..400e013 100644
--- a/.github/workflows/dockerbuild.yml
+++ b/.github/workflows/dockerbuild.yml
@@ -49,7 +49,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.GH_TOKEN }}
 
       - name: Ghcr Build and push
         id: docker_build

From a8e122ce08fe9d813c626f532b96a0fd4dce372c Mon Sep 17 00:00:00 2001
From: Aditya <60684641+0x0elliot@users.noreply.github.com>
Date: Tue, 12 May 2026 17:36:21 +0530
Subject: [PATCH 08/25] ci: token name change

---
 .github/workflows/docker-release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index 7a34e8d..35f63ee 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -53,7 +53,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.GH_TOKEN }}
+          password: ${{ secrets.PUSH_PAT }}
 
       - name: Determine build type and version
         id: version

From 59f646c8d9ac856a5966e0e9c7b6d2e4a65084b2 Mon Sep 17 00:00:00 2001
From: Aditya <60684641+0x0elliot@users.noreply.github.com>
Date: Tue, 12 May 2026 18:20:13 +0530
Subject: [PATCH 09/25] Use GITHUB_TOKEN for GHCR and remove non-existent
 registry tags

---
 .github/workflows/docker-release.yml      | 8 +-------
 .github/workflows/dockerbuild-nightly.yml | 4 +---
 .github/workflows/dockerbuild.yml         | 2 +-
 3 files changed, 3 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index 35f63ee..daf93f6 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -53,7 +53,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.PUSH_PAT }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Determine build type and version
         id: version
@@ -89,9 +89,7 @@ jobs:
           cache-to: type=gha,mode=max
           tags: |
             ghcr.io/shuffle/shuffle-orborus:latest
-            ghcr.io/shuffle-orborus/shuffle-orborus:latest
             ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:latest
-            shuffle-orborus/shuffle-orborus:latest
             frikky/shuffle-orborus:latest
             frikky/shuffle:orborus
 
@@ -108,11 +106,7 @@ jobs:
           tags: |
             ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.version }}
             ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
-            ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.version }}
-            ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
             ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:${{ steps.version.outputs.version }}
             ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
-            shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.version }}
-            shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
             frikky/shuffle-orborus:${{ steps.version.outputs.version }}
             frikky/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
diff --git a/.github/workflows/dockerbuild-nightly.yml b/.github/workflows/dockerbuild-nightly.yml
index b13a48f..c7fa3cd 100644
--- a/.github/workflows/dockerbuild-nightly.yml
+++ b/.github/workflows/dockerbuild-nightly.yml
@@ -49,7 +49,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.GH_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Ghcr Build and push
         id: docker_build
@@ -63,9 +63,7 @@ jobs:
           cache-to: type=gha,mode=max
           tags: |
             ghcr.io/shuffle/${{ matrix.app }}:${{ matrix.version }}
-            ghcr.io/shuffle-orborus/shuffle-${{ matrix.app }}:${{ matrix.version }}
             ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-${{ matrix.app }}:${{ matrix.version }}
-            shuffle-orborus/shuffle-${{ matrix.app }}:${{ matrix.version }}
             frikky/shuffle-${{ matrix.app }}:${{ matrix.version }}
             frikky/shuffle:${{ matrix.app }}
 
diff --git a/.github/workflows/dockerbuild.yml b/.github/workflows/dockerbuild.yml
index 400e013..0e7734f 100644
--- a/.github/workflows/dockerbuild.yml
+++ b/.github/workflows/dockerbuild.yml
@@ -49,7 +49,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.GH_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Ghcr Build and push
         id: docker_build

From b49b9054a4c445eaa6f0f612e5369c3e1010c4f2 Mon Sep 17 00:00:00 2001
From: Aditya <60684641+0x0elliot@users.noreply.github.com>
Date: Tue, 12 May 2026 18:21:54 +0530
Subject: [PATCH 10/25] Tag latest builds as 2.2.1

---
 .github/workflows/docker-release.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index daf93f6..73785ed 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -88,9 +88,9 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           tags: |
-            ghcr.io/shuffle/shuffle-orborus:latest
-            ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:latest
-            frikky/shuffle-orborus:latest
+            ghcr.io/shuffle/shuffle-orborus:2.2.1  # TODO: bump when releasing
+            ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:2.2.1
+            frikky/shuffle-orborus:2.2.1
             frikky/shuffle:orborus
 
       - name: Build and push (release with aliases)

From e7d8fe7aa0fae07e897d7300c612250fc835df2c Mon Sep 17 00:00:00 2001
From: Aditya <60684641+0x0elliot@users.noreply.github.com>
Date: Tue, 12 May 2026 18:22:29 +0530
Subject: [PATCH 11/25] ci: commit to trigger build


From 00dfc660128f334360f99892d9e8a81e4e60c553 Mon Sep 17 00:00:00 2001
From: Aditya <60684641+0x0elliot@users.noreply.github.com>
Date: Tue, 12 May 2026 18:48:48 +0530
Subject: [PATCH 12/25] ci: trigger build

---
 orborus.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/orborus.go b/orborus.go
index c7e697e..d2bb813 100755
--- a/orborus.go
+++ b/orborus.go
@@ -1,7 +1,7 @@
 package main
 
 /*
-	Orborus exists to listen for new jobs from Shuffle. This is to run workflows, pipelines, and other tasks.
+  	Orborus exists to listen for new jobs from Shuffle. This is to run workflows, pipelines, and other tasks.
 */
 import (
 	"archive/zip"

From 33ae8e822e149e733ddfa292c6fd7d750e3e9ec3 Mon Sep 17 00:00:00 2001
From: Aditya <60684641+0x0elliot@users.noreply.github.com>
Date: Wed, 13 May 2026 00:40:09 +0530
Subject: [PATCH 13/25] fix: native cross-compile, per-registry failure
 isolation, consolidate workflows

---
 .dockerignore                        |  6 ++
 .github/workflows/docker-release.yml | 94 ++++++++++++++++++++++++----
 .github/workflows/dockerbuild.yml    | 73 ---------------------
 Dockerfile                           |  8 +--
 4 files changed, 92 insertions(+), 89 deletions(-)
 create mode 100644 .dockerignore
 delete mode 100644 .github/workflows/dockerbuild.yml

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..a813a8a
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,6 @@
+.git
+.github
+.gitignore
+.claude
+helpers
+*.md
diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index 73785ed..eae06fe 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -40,7 +40,7 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
         with:
-          platforms: "amd64,arm64,arm"
+          platforms: "amd64,arm64"
 
       - name: Login to DockerHub
         uses: docker/login-action@v3
@@ -72,12 +72,13 @@ jobs:
           echo "build_type=${BUILD_TYPE}" >> $GITHUB_OUTPUT
           echo "version=${VERSION}" >> $GITHUB_OUTPUT
 
-          # Strip 'v' prefix if present
           STRIPPED_VERSION=$(echo "${VERSION}" | sed 's/^v//')
           echo "stripped_version=${STRIPPED_VERSION}" >> $GITHUB_OUTPUT
           echo "Version: ${VERSION}, Stripped: ${STRIPPED_VERSION}, Type: ${BUILD_TYPE}"
 
-      - name: Build and push (latest)
+      # === LATEST BUILD (push to main or workflow_dispatch) ===
+
+      - name: Build and push latest to ghcr.io/shuffle (primary)
         if: steps.version.outputs.build_type == 'latest' || steps.version.outputs.build_type == 'both'
         uses: docker/build-push-action@v5
         with:
@@ -88,12 +89,49 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           tags: |
-            ghcr.io/shuffle/shuffle-orborus:2.2.1  # TODO: bump when releasing
-            ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:2.2.1
-            frikky/shuffle-orborus:2.2.1
-            frikky/shuffle:orborus
+            ghcr.io/shuffle/shuffle-orborus:latest
+            ghcr.io/shuffle/shuffle-orborus:2.2.1
+
+      - name: Copy latest to ghcr.io/shuffle-orborus
+        if: steps.version.outputs.build_type == 'latest' || steps.version.outputs.build_type == 'both'
+        continue-on-error: true
+        run: |
+          docker buildx imagetools create \
+            --tag ghcr.io/shuffle-orborus/shuffle-orborus:latest \
+            --tag ghcr.io/shuffle-orborus/shuffle-orborus:2.2.1 \
+            ghcr.io/shuffle/shuffle-orborus:latest
 
-      - name: Build and push (release with aliases)
+      - name: Copy latest to DockerHub
+        if: steps.version.outputs.build_type == 'latest' || steps.version.outputs.build_type == 'both'
+        continue-on-error: true
+        run: |
+          docker buildx imagetools create \
+            --tag ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:latest \
+            --tag ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:2.2.1 \
+            ghcr.io/shuffle/shuffle-orborus:latest
+
+      - name: Copy latest to shuffle-orborus DockerHub
+        if: steps.version.outputs.build_type == 'latest' || steps.version.outputs.build_type == 'both'
+        continue-on-error: true
+        run: |
+          docker buildx imagetools create \
+            --tag shuffle-orborus/shuffle-orborus:latest \
+            --tag shuffle-orborus/shuffle-orborus:2.2.1 \
+            ghcr.io/shuffle/shuffle-orborus:latest
+
+      - name: Copy latest to frikky
+        if: steps.version.outputs.build_type == 'latest' || steps.version.outputs.build_type == 'both'
+        continue-on-error: true
+        run: |
+          docker buildx imagetools create \
+            --tag frikky/shuffle-orborus:latest \
+            --tag frikky/shuffle-orborus:2.2.1 \
+            --tag frikky/shuffle:orborus \
+            ghcr.io/shuffle/shuffle-orborus:latest
+
+      # === RELEASE BUILD (GitHub release or workflow_dispatch) ===
+
+      - name: Build and push release to ghcr.io/shuffle (primary)
         if: steps.version.outputs.build_type == 'release' || steps.version.outputs.build_type == 'both'
         uses: docker/build-push-action@v5
         with:
@@ -106,7 +144,39 @@ jobs:
           tags: |
             ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.version }}
             ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
-            ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:${{ steps.version.outputs.version }}
-            ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
-            frikky/shuffle-orborus:${{ steps.version.outputs.version }}
-            frikky/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
+
+      - name: Copy release to ghcr.io/shuffle-orborus
+        if: steps.version.outputs.build_type == 'release' || steps.version.outputs.build_type == 'both'
+        continue-on-error: true
+        run: |
+          docker buildx imagetools create \
+            --tag ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.version }} \
+            --tag ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.stripped_version }} \
+            ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.version }}
+
+      - name: Copy release to DockerHub
+        if: steps.version.outputs.build_type == 'release' || steps.version.outputs.build_type == 'both'
+        continue-on-error: true
+        run: |
+          docker buildx imagetools create \
+            --tag ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:${{ steps.version.outputs.version }} \
+            --tag ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:${{ steps.version.outputs.stripped_version }} \
+            ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.version }}
+
+      - name: Copy release to shuffle-orborus DockerHub
+        if: steps.version.outputs.build_type == 'release' || steps.version.outputs.build_type == 'both'
+        continue-on-error: true
+        run: |
+          docker buildx imagetools create \
+            --tag shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.version }} \
+            --tag shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.stripped_version }} \
+            ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.version }}
+
+      - name: Copy release to frikky
+        if: steps.version.outputs.build_type == 'release' || steps.version.outputs.build_type == 'both'
+        continue-on-error: true
+        run: |
+          docker buildx imagetools create \
+            --tag frikky/shuffle-orborus:${{ steps.version.outputs.version }} \
+            --tag frikky/shuffle-orborus:${{ steps.version.outputs.stripped_version }} \
+            ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.version }}
diff --git a/.github/workflows/dockerbuild.yml b/.github/workflows/dockerbuild.yml
deleted file mode 100644
index 0e7734f..0000000
--- a/.github/workflows/dockerbuild.yml
+++ /dev/null
@@ -1,73 +0,0 @@
-name: latest-dockerbuild
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-    paths:
-      - "**"
-      - "!.github/**"
-      - "!**.md"
-      - "!docker-compose.yml"
-permissions:
-  contents: read
-  packages: write
-
-jobs:
-  main:
-    runs-on: ubuntu-latest
-    continue-on-error: ${{ matrix.experimental }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - app: orborus
-            path: ./
-            version: latest
-            experimental: true
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-        with:
-          platforms: "amd64,arm64,arm"
-
-      - name: Login to DockerHub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Login to Ghcr
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Ghcr Build and push
-        id: docker_build
-        uses: docker/build-push-action@v5
-        with:
-          context: ${{ matrix.path }}/
-          file: ${{ matrix.path }}/Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: |
-            ghcr.io/shuffle/shuffle-${{ matrix.app }}:${{ matrix.version }}
-            ghcr.io/shuffle-orborus/shuffle-${{ matrix.app }}:${{ matrix.version }}
-            ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-${{ matrix.app }}:${{ matrix.version }}
-            shuffle-orborus/shuffle-${{ matrix.app }}:${{ matrix.version }}
-            frikky/shuffle-${{ matrix.app }}:${{ matrix.version }}
-            frikky/shuffle:${{ matrix.app }}
-
-      - name: Image digest
-        run: echo ${{ steps.docker_build.outputs.digest }}
diff --git a/Dockerfile b/Dockerfile
index d535bc5..56a14dc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,5 @@
-FROM golang:1.25 AS builder
+FROM --platform=$BUILDPLATFORM golang:1.25 AS builder
+ARG TARGETOS TARGETARCH
 
 WORKDIR /app
 
@@ -6,13 +7,12 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN CGO_ENABLED=0 GOOS=linux go build -o /app/orborus .
+RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o /app/orborus .
 
 FROM alpine:3.22.1
 
 RUN apk add --no-cache bash tzdata
-#COPY --from=builder /app/orborus orborus
-COPY --from=builder /app/ /
+COPY --from=builder /app/orborus /orborus
 ENV ENVIRONMENT_NAME=Shuffle \
     BASE_URL=http://shuffle-backend:5001 \
     DOCKER_API_VERSION=1.40 \

From 080649069f474e99657c11366eee876c576c1be0 Mon Sep 17 00:00:00 2001
From: Aditya <60684641+0x0elliot@users.noreply.github.com>
Date: Wed, 13 May 2026 00:54:59 +0530
Subject: [PATCH 14/25] fix: use shuffle-orborus as primary ghcr registry, use
 GITHUB_TOKEN everywhere

---
 .github/workflows/docker-release.yml   | 42 ++++++++------------------
 .github/workflows/release_binaries.yml |  2 +-
 2 files changed, 13 insertions(+), 31 deletions(-)

diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index eae06fe..4c3be29 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -78,7 +78,7 @@ jobs:
 
       # === LATEST BUILD (push to main or workflow_dispatch) ===
 
-      - name: Build and push latest to ghcr.io/shuffle (primary)
+      - name: Build and push latest (primary)
         if: steps.version.outputs.build_type == 'latest' || steps.version.outputs.build_type == 'both'
         uses: docker/build-push-action@v5
         with:
@@ -89,17 +89,8 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           tags: |
-            ghcr.io/shuffle/shuffle-orborus:latest
-            ghcr.io/shuffle/shuffle-orborus:2.2.1
-
-      - name: Copy latest to ghcr.io/shuffle-orborus
-        if: steps.version.outputs.build_type == 'latest' || steps.version.outputs.build_type == 'both'
-        continue-on-error: true
-        run: |
-          docker buildx imagetools create \
-            --tag ghcr.io/shuffle-orborus/shuffle-orborus:latest \
-            --tag ghcr.io/shuffle-orborus/shuffle-orborus:2.2.1 \
-            ghcr.io/shuffle/shuffle-orborus:latest
+            ghcr.io/shuffle-orborus/shuffle-orborus:latest
+            ghcr.io/shuffle-orborus/shuffle-orborus:2.2.1
 
       - name: Copy latest to DockerHub
         if: steps.version.outputs.build_type == 'latest' || steps.version.outputs.build_type == 'both'
@@ -108,7 +99,7 @@ jobs:
           docker buildx imagetools create \
             --tag ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:latest \
             --tag ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:2.2.1 \
-            ghcr.io/shuffle/shuffle-orborus:latest
+            ghcr.io/shuffle-orborus/shuffle-orborus:latest
 
       - name: Copy latest to shuffle-orborus DockerHub
         if: steps.version.outputs.build_type == 'latest' || steps.version.outputs.build_type == 'both'
@@ -117,7 +108,7 @@ jobs:
           docker buildx imagetools create \
             --tag shuffle-orborus/shuffle-orborus:latest \
             --tag shuffle-orborus/shuffle-orborus:2.2.1 \
-            ghcr.io/shuffle/shuffle-orborus:latest
+            ghcr.io/shuffle-orborus/shuffle-orborus:latest
 
       - name: Copy latest to frikky
         if: steps.version.outputs.build_type == 'latest' || steps.version.outputs.build_type == 'both'
@@ -127,11 +118,11 @@ jobs:
             --tag frikky/shuffle-orborus:latest \
             --tag frikky/shuffle-orborus:2.2.1 \
             --tag frikky/shuffle:orborus \
-            ghcr.io/shuffle/shuffle-orborus:latest
+            ghcr.io/shuffle-orborus/shuffle-orborus:latest
 
       # === RELEASE BUILD (GitHub release or workflow_dispatch) ===
 
-      - name: Build and push release to ghcr.io/shuffle (primary)
+      - name: Build and push release (primary)
         if: steps.version.outputs.build_type == 'release' || steps.version.outputs.build_type == 'both'
         uses: docker/build-push-action@v5
         with:
@@ -142,17 +133,8 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           tags: |
-            ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.version }}
-            ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
-
-      - name: Copy release to ghcr.io/shuffle-orborus
-        if: steps.version.outputs.build_type == 'release' || steps.version.outputs.build_type == 'both'
-        continue-on-error: true
-        run: |
-          docker buildx imagetools create \
-            --tag ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.version }} \
-            --tag ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.stripped_version }} \
-            ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.version }}
+            ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.version }}
+            ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
 
       - name: Copy release to DockerHub
         if: steps.version.outputs.build_type == 'release' || steps.version.outputs.build_type == 'both'
@@ -161,7 +143,7 @@ jobs:
           docker buildx imagetools create \
             --tag ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:${{ steps.version.outputs.version }} \
             --tag ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:${{ steps.version.outputs.stripped_version }} \
-            ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.version }}
+            ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.version }}
 
       - name: Copy release to shuffle-orborus DockerHub
         if: steps.version.outputs.build_type == 'release' || steps.version.outputs.build_type == 'both'
@@ -170,7 +152,7 @@ jobs:
           docker buildx imagetools create \
             --tag shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.version }} \
             --tag shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.stripped_version }} \
-            ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.version }}
+            ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.version }}
 
       - name: Copy release to frikky
         if: steps.version.outputs.build_type == 'release' || steps.version.outputs.build_type == 'both'
@@ -179,4 +161,4 @@ jobs:
           docker buildx imagetools create \
             --tag frikky/shuffle-orborus:${{ steps.version.outputs.version }} \
             --tag frikky/shuffle-orborus:${{ steps.version.outputs.stripped_version }} \
-            ghcr.io/shuffle/shuffle-orborus:${{ steps.version.outputs.version }}
+            ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.version }}
diff --git a/.github/workflows/release_binaries.yml b/.github/workflows/release_binaries.yml
index bbf9ce1..09929b4 100644
--- a/.github/workflows/release_binaries.yml
+++ b/.github/workflows/release_binaries.yml
@@ -106,4 +106,4 @@ jobs:
         with:
           tag_name: ${{ github.event.inputs.version }}
           files: dist/*
-          token: ${{ secrets.GH_TOKEN }}
+          token: ${{ secrets.GITHUB_TOKEN }}

From 3c23b655ab73e02fda68c27e3a354fa604a167f5 Mon Sep 17 00:00:00 2001
From: Aditya <60684641+0x0elliot@users.noreply.github.com>
Date: Wed, 13 May 2026 02:56:53 +0530
Subject: [PATCH 15/25] chore: fix ghcr registry to shuffle/orborus

---
 .github/workflows/docker-release.yml | 48 ++++++++++++++--------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index 4c3be29..97be5da 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -89,36 +89,36 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           tags: |
-            ghcr.io/shuffle-orborus/shuffle-orborus:latest
-            ghcr.io/shuffle-orborus/shuffle-orborus:2.2.1
+            ghcr.io/shuffle/orborus:latest
+            ghcr.io/shuffle/orborus:2.2.1
 
       - name: Copy latest to DockerHub
         if: steps.version.outputs.build_type == 'latest' || steps.version.outputs.build_type == 'both'
         continue-on-error: true
         run: |
           docker buildx imagetools create \
-            --tag ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:latest \
-            --tag ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:2.2.1 \
-            ghcr.io/shuffle-orborus/shuffle-orborus:latest
+            --tag ${{ secrets.DOCKERHUB_USERNAME }}/orborus:latest \
+            --tag ${{ secrets.DOCKERHUB_USERNAME }}/orborus:2.2.1 \
+            ghcr.io/shuffle/orborus:latest
 
-      - name: Copy latest to shuffle-orborus DockerHub
+      - name: Copy latest to shuffle DockerHub
         if: steps.version.outputs.build_type == 'latest' || steps.version.outputs.build_type == 'both'
         continue-on-error: true
         run: |
           docker buildx imagetools create \
-            --tag shuffle-orborus/shuffle-orborus:latest \
-            --tag shuffle-orborus/shuffle-orborus:2.2.1 \
-            ghcr.io/shuffle-orborus/shuffle-orborus:latest
+            --tag shuffle/orborus:latest \
+            --tag shuffle/orborus:2.2.1 \
+            ghcr.io/shuffle/orborus:latest
 
       - name: Copy latest to frikky
         if: steps.version.outputs.build_type == 'latest' || steps.version.outputs.build_type == 'both'
         continue-on-error: true
         run: |
           docker buildx imagetools create \
-            --tag frikky/shuffle-orborus:latest \
-            --tag frikky/shuffle-orborus:2.2.1 \
+            --tag frikky/orborus:latest \
+            --tag frikky/orborus:2.2.1 \
             --tag frikky/shuffle:orborus \
-            ghcr.io/shuffle-orborus/shuffle-orborus:latest
+            ghcr.io/shuffle/orborus:latest
 
       # === RELEASE BUILD (GitHub release or workflow_dispatch) ===
 
@@ -133,32 +133,32 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           tags: |
-            ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.version }}
-            ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.stripped_version }}
+            ghcr.io/shuffle/orborus:${{ steps.version.outputs.version }}
+            ghcr.io/shuffle/orborus:${{ steps.version.outputs.stripped_version }}
 
       - name: Copy release to DockerHub
         if: steps.version.outputs.build_type == 'release' || steps.version.outputs.build_type == 'both'
         continue-on-error: true
         run: |
           docker buildx imagetools create \
-            --tag ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:${{ steps.version.outputs.version }} \
-            --tag ${{ secrets.DOCKERHUB_USERNAME }}/shuffle-orborus:${{ steps.version.outputs.stripped_version }} \
-            ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.version }}
+            --tag ${{ secrets.DOCKERHUB_USERNAME }}/orborus:${{ steps.version.outputs.version }} \
+            --tag ${{ secrets.DOCKERHUB_USERNAME }}/orborus:${{ steps.version.outputs.stripped_version }} \
+            ghcr.io/shuffle/orborus:${{ steps.version.outputs.version }}
 
-      - name: Copy release to shuffle-orborus DockerHub
+      - name: Copy release to shuffle DockerHub
         if: steps.version.outputs.build_type == 'release' || steps.version.outputs.build_type == 'both'
         continue-on-error: true
         run: |
           docker buildx imagetools create \
-            --tag shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.version }} \
-            --tag shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.stripped_version }} \
-            ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.version }}
+            --tag shuffle/orborus:${{ steps.version.outputs.version }} \
+            --tag shuffle/orborus:${{ steps.version.outputs.stripped_version }} \
+            ghcr.io/shuffle/orborus:${{ steps.version.outputs.version }}
 
       - name: Copy release to frikky
         if: steps.version.outputs.build_type == 'release' || steps.version.outputs.build_type == 'both'
         continue-on-error: true
         run: |
           docker buildx imagetools create \
-            --tag frikky/shuffle-orborus:${{ steps.version.outputs.version }} \
-            --tag frikky/shuffle-orborus:${{ steps.version.outputs.stripped_version }} \
-            ghcr.io/shuffle-orborus/shuffle-orborus:${{ steps.version.outputs.version }}
+            --tag frikky/orborus:${{ steps.version.outputs.version }} \
+            --tag frikky/orborus:${{ steps.version.outputs.stripped_version }} \
+            ghcr.io/shuffle/orborus:${{ steps.version.outputs.version }}

From 4bf252c7aa169a9e7a49d8e04c03c8a4467b34ed Mon Sep 17 00:00:00 2001
From: Aditya <60684641+0x0elliot@users.noreply.github.com>
Date: Wed, 13 May 2026 03:12:49 +0530
Subject: [PATCH 16/25] ci: trigger build

---
 orborus.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/orborus.go b/orborus.go
index d2bb813..6ec1047 100755
--- a/orborus.go
+++ b/orborus.go
@@ -1,7 +1,7 @@
 package main
 
 /*
-  	Orborus exists to listen for new jobs from Shuffle. This is to run workflows, pipelines, and other tasks.
+  Orborus exists to listen for new jobs from Shuffle. This is to run workflows, pipelines, and other tasks.
 */
 import (
 	"archive/zip"

From bc2fcc8eb1c5110da80a573a9bec07b59cadaadc Mon Sep 17 00:00:00 2001
From: Lalit Deore <lalitdeore12@gmail.com>
Date: Wed, 13 May 2026 18:00:53 +0530
Subject: [PATCH 17/25] fix - docker version issue

---
 Dockerfile                 | 2 +-
 helpers/docker-compose.yml | 2 +-
 helpers/run.sh             | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 56a14dc..9c80a4f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,7 +15,7 @@ RUN apk add --no-cache bash tzdata
 COPY --from=builder /app/orborus /orborus
 ENV ENVIRONMENT_NAME=Shuffle \
     BASE_URL=http://shuffle-backend:5001 \
-    DOCKER_API_VERSION=1.40 \
+    DOCKER_API_VERSION=1.44 \
     SHUFFLE_OPENSEARCH_URL=https://opensearch:9200
 
 CMD ["./orborus"]
diff --git a/helpers/docker-compose.yml b/helpers/docker-compose.yml
index ef6132e..e3d680a 100644
--- a/helpers/docker-compose.yml
+++ b/helpers/docker-compose.yml
@@ -12,7 +12,7 @@ services:
       - ORG_ID=Shuffle
       - ENVIRONMENT_NAME=Shuffle
       - BASE_URL=http://192.168.86.39:5001
-      - DOCKER_API_VERSION=1.40
+      - DOCKER_API_VERSION=1.44
       - SHUFFLE_SCALE_REPLICAS=5
       - SHUFFLE_SWARM_CONFIG=run
     restart: unless-stopped
diff --git a/helpers/run.sh b/helpers/run.sh
index d71ac59..a8566a9 100755
--- a/helpers/run.sh
+++ b/helpers/run.sh
@@ -10,7 +10,7 @@
 #	ghcr.io/frikky/shuffle-orborus:nightly
 
 docker run \
-	--env DOCKER_API_VERSION=1.40 \
+	--env DOCKER_API_VERSION=1.44 \
 	--env ENVIRONMENT_NAME="Another env" \
 	--env ORG="2e7b6a08-b63b-4fc2-bd70-718091509db1" \
 	--env AUTH="env auth" \

From db457bb28a4e45ac2831c29491cef4b7a67deb4c Mon Sep 17 00:00:00 2001
From: Frikky <frikky@shuffler.io>
Date: Thu, 14 May 2026 17:45:26 +0200
Subject: [PATCH 18/25] Making sure shuffle-worker is renamed correctly

---
 orborus.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/orborus.go b/orborus.go
index 6ec1047..a5b1403 100755
--- a/orborus.go
+++ b/orborus.go
@@ -4776,7 +4776,7 @@ func sendWorkerRequest(workflowExecution shuffle.ExecutionRequest, image string,
 
 			// Never happening but okay
 			if strings.Contains(fmt.Sprintf("%s", err), "connection refused") || strings.Contains(fmt.Sprintf("%s", err), "EOF") {
-				workerImage := fmt.Sprintf("ghcr.io/shuffle/shuffle-worker:%s", workerVersion)
+				workerImage := fmt.Sprintf("ghcr.io/shuffle/shuffle-workers:%s", workerVersion)
 				if len(newWorkerImage) > 0 {
 					workerImage = newWorkerImage
 				}
@@ -4809,7 +4809,7 @@ func sendWorkerRequest(workflowExecution shuffle.ExecutionRequest, image string,
 			}
 
 			if strings.Contains(fmt.Sprintf("%s", err), "connection refused") || strings.Contains(fmt.Sprintf("%s", err), "EOF") {
-				workerImage := fmt.Sprintf("ghcr.io/shuffle/shuffle-worker:%s", workerVersion)
+				workerImage := fmt.Sprintf("ghcr.io/shuffle/shuffle-workers:%s", workerVersion)
 				if len(newWorkerImage) > 0 {
 					workerImage = newWorkerImage
 				}

From 50539b124de738ad25e3f0e1643a0c8f7da7b507 Mon Sep 17 00:00:00 2001
From: Frikky <frikky@shuffler.io>
Date: Thu, 14 May 2026 17:50:29 +0200
Subject: [PATCH 19/25] Forcing in workerVersion

---
 orborus.go | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/orborus.go b/orborus.go
index a5b1403..e52e70a 100755
--- a/orborus.go
+++ b/orborus.go
@@ -2771,7 +2771,6 @@ func mainLoop() {
 		// FIXME - during init, BUILD and/or LOAD worker and app_sdk
 		// Build/load app_sdk so it can be loaded as 127.0.0.1:5000/walkoff_app_sdk
 		log.Printf("[INFO] Setting up Docker environment. Downloading worker and App SDK!")
-
 		initializeImages()
 
 		if swarmConfig == "run" || swarmConfig == "swarm" || isKubernetes == "true" {
@@ -4776,7 +4775,11 @@ func sendWorkerRequest(workflowExecution shuffle.ExecutionRequest, image string,
 
 			// Never happening but okay
 			if strings.Contains(fmt.Sprintf("%s", err), "connection refused") || strings.Contains(fmt.Sprintf("%s", err), "EOF") {
-				workerImage := fmt.Sprintf("ghcr.io/shuffle/shuffle-workers:%s", workerVersion)
+				if workerVersion == "" { 
+					workerVersion = "latest"
+				}
+
+				workerImage := fmt.Sprintf("ghcr.io/shuffle/shuffle-worker:%s", workerVersion)
 				if len(newWorkerImage) > 0 {
 					workerImage = newWorkerImage
 				}
@@ -4809,7 +4812,11 @@ func sendWorkerRequest(workflowExecution shuffle.ExecutionRequest, image string,
 			}
 
 			if strings.Contains(fmt.Sprintf("%s", err), "connection refused") || strings.Contains(fmt.Sprintf("%s", err), "EOF") {
-				workerImage := fmt.Sprintf("ghcr.io/shuffle/shuffle-workers:%s", workerVersion)
+				if len(workerVersion) == 0 {
+					workerVersion = "latest"
+				}
+
+				workerImage := fmt.Sprintf("ghcr.io/shuffle/shuffle-worker:%s", workerVersion)
 				if len(newWorkerImage) > 0 {
 					workerImage = newWorkerImage
 				}

From 6bceb9a7b8f72b7010993a781ade593ff344f0a2 Mon Sep 17 00:00:00 2001
From: Frikky <frikky@shuffler.io>
Date: Thu, 14 May 2026 18:27:57 +0200
Subject: [PATCH 20/25] Made re-attaching to network optional

---
 orborus.go | 40 ++++++++++++++++++++++++++++------------
 1 file changed, 28 insertions(+), 12 deletions(-)

diff --git a/orborus.go b/orborus.go
index e52e70a..b87ad91 100755
--- a/orborus.go
+++ b/orborus.go
@@ -879,22 +879,38 @@ func deployServiceWorkers(image string) {
 		services, serr := dockercli.ServiceList(ctx, types.ServiceListOptions{})
 		if serr == nil {
 			for _, svc := range services {
-				if svc.Spec.Annotations.Name == innerContainerName {
-					log.Printf("[DEBUG] Found service %s (%s) — patching network attach", innerContainerName, svc.ID)
-
-					spec := svc.Spec
-					spec.TaskTemplate.Networks = append(spec.TaskTemplate.Networks, swarm.NetworkAttachmentConfig{
-						Target: networkID,
-					})
+				if svc.Spec.Annotations.Name != innerContainerName {
+					continue
+				}
 
-					_, uerr := dockercli.ServiceUpdate(ctx, svc.ID, svc.Version, spec, types.ServiceUpdateOptions{})
-					if uerr != nil {
-						log.Printf("[WARNING] Failed to patch service %s with network %s: %v", innerContainerName, networkID, uerr)
-					} else {
-						log.Printf("[INFO] Successfully attached network %s to service %s", networkID, innerContainerName)
+				// Check if the network already exists or not
+				networkFound := false
+				for _, net := range svc.Spec.TaskTemplate.Networks {
+					if net.Target == networkID {
+						networkFound = true
+						break
 					}
+				}
+
+				if networkFound {
+					log.Printf("[DEBUG] Network %s already attached to service %s, skipping patch", networkID, innerContainerName)
 					break
 				}
+
+				log.Printf("[DEBUG] Found service %s (%s) — patching network attach", innerContainerName, svc.ID)
+
+				spec := svc.Spec
+				spec.TaskTemplate.Networks = append(spec.TaskTemplate.Networks, swarm.NetworkAttachmentConfig{
+					Target: networkID,
+				})
+
+				_, uerr := dockercli.ServiceUpdate(ctx, svc.ID, svc.Version, spec, types.ServiceUpdateOptions{})
+				if uerr != nil {
+					log.Printf("[WARNING] Failed to patch service %s with network %s: %v", innerContainerName, networkID, uerr)
+				} else {
+					log.Printf("[INFO] Successfully attached network %s to service %s", networkID, innerContainerName)
+				}
+				break
 			}
 		} else {
 			log.Printf("[WARNING] Failed to list services for patching network attach: %v", serr)

From fb2ce39a3797affe5e0c126eccdbc5596ef19b83 Mon Sep 17 00:00:00 2001
From: yashsinghcodes <yash9vardhan@gmail.com>
Date: Tue, 26 May 2026 18:26:27 +0530
Subject: [PATCH 21/25] remove ingress attachment

---
 orborus.go | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/orborus.go b/orborus.go
index b87ad91..4803996 100755
--- a/orborus.go
+++ b/orborus.go
@@ -697,15 +697,11 @@ func deployServiceWorkers(image string) {
 				Replicas: &replicatedJobs,
 			},
 		},
-		Networks: func() []swarm.NetworkAttachmentConfig {
-			networks := []swarm.NetworkAttachmentConfig{
-				{Target: networkID},
-			}
-			if strings.ToLower(os.Getenv("SHUFFLE_ATTACH_INGRESS_NETWORK")) != "false" {
-				networks = append(networks, swarm.NetworkAttachmentConfig{Target: "ingress"})
-			}
-			return networks
-		}(),
+		Networks: []swarm.NetworkAttachmentConfig{
+			swarm.NetworkAttachmentConfig{
+				Target: networkID,
+			},
+		},
 		EndpointSpec: &swarm.EndpointSpec{
 			Mode: "vip",
 			Ports: []swarm.PortConfig{

From 2d320889a1db1b6178ff92a6b7da99c489aab730 Mon Sep 17 00:00:00 2001
From: yashsinghcodes <yash9vardhan@gmail.com>
Date: Tue, 26 May 2026 20:24:21 +0530
Subject: [PATCH 22/25] added ablity to pass app proxy with worker in between

---
 orborus.go | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/orborus.go b/orborus.go
index 4803996..c7690ee 100755
--- a/orborus.go
+++ b/orborus.go
@@ -798,6 +798,15 @@ func deployServiceWorkers(image string) {
 		serviceSpec.TaskTemplate.ContainerSpec.Env = append(serviceSpec.TaskTemplate.ContainerSpec.Env, fmt.Sprintf("no_proxy=%s", os.Getenv("no_proxy")))
 	}
 
+	if strings.ToLower(os.Getenv("SHUFFLE_PASS_APP_PROXY")) == "true" {
+		serviceSpec.TaskTemplate.ContainerSpec.Env = append(serviceSpec.TaskTemplate.ContainerSpec.Env, fmt.Sprintf("SHUFFLE_APP_HTTP_PROXY=%s", os.Getenv("HTTP_PROXY")))
+		serviceSpec.TaskTemplate.ContainerSpec.Env = append(serviceSpec.TaskTemplate.ContainerSpec.Env, fmt.Sprintf("SHUFFLE_APP_HTTPS_PROXY=%s", os.Getenv("HTTPS_PROXY")))
+		serviceSpec.TaskTemplate.ContainerSpec.Env = append(serviceSpec.TaskTemplate.ContainerSpec.Env, fmt.Sprintf("SHUFFLE_APP_NO_PROXY=%s", os.Getenv("NO_PROXY")))
+		serviceSpec.TaskTemplate.ContainerSpec.Env = append(serviceSpec.TaskTemplate.ContainerSpec.Env, fmt.Sprintf("SHUFFLE_APP_no_proxy=%s", os.Getenv("no_proxy")))
+	}
+
+	serviceSpec.TaskTemplate.ContainerSpec.Env = append(serviceSpec.TaskTemplate.ContainerSpec.Env, fmt.Sprintf("SHUFFLE_PASS_APP_PROXY=%s", os.Getenv("SHUFFLE_PASS_APP_PROXY")))
+
 	if len(workerServerUrl) > 0 {
 		serviceSpec.TaskTemplate.ContainerSpec.Env = append(serviceSpec.TaskTemplate.ContainerSpec.Env, fmt.Sprintf("SHUFFLE_WORKER_SERVER_URL=%s", os.Getenv("SHUFFLE_WORKER_SERVER_URL")))
 	}

From ba581d8bb98c92fe982218f0740cc63a2ddf0497 Mon Sep 17 00:00:00 2001
From: yashsinghcodes <yash9vardhan@gmail.com>
Date: Tue, 16 Jun 2026 10:52:34 +0530
Subject: [PATCH 23/25] fix: removeFile

---
 orborus.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/orborus.go b/orborus.go
index c7690ee..1869738 100755
--- a/orborus.go
+++ b/orborus.go
@@ -4379,7 +4379,8 @@ func removeFile(fileName string) error {
 	containerName := "tenzir-node"
 	srcPath := fmt.Sprintf("/var/lib/tenzir/sigma_rules/%s", fileName)
 
-	checkSrcCmd := exec.Command("docker", "exec", containerName, "sh", "-c", fmt.Sprintf("test -f %s", srcPath))
+	//checkSrcCmd := exec.Command("docker", "exec", containerName, "sh", "-c", fmt.Sprintf("test -f %s", srcPath))
+	checkSrcCmd := exec.Command("docker", "exec", containerName, "test", "-f", srcPath)
 	if err := checkSrcCmd.Run(); err != nil {
 		// If the file does not exist, simply return nil
 		if exitErr, ok := err.(*exec.ExitError); ok && exitErr.ExitCode() == 1 {

From 9f403158cbe865394f37b4b9e5b946bf660247f9 Mon Sep 17 00:00:00 2001
From: yashsinghcodes <yash9vardhan@gmail.com>
Date: Mon, 29 Jun 2026 10:54:53 +0530
Subject: [PATCH 24/25] fix: default tag worker fix

---
 orborus.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/orborus.go b/orborus.go
index 1869738..3614138 100755
--- a/orborus.go
+++ b/orborus.go
@@ -1883,6 +1883,11 @@ func initializeImages() {
 
 	log.Printf("[DEBUG] Setting swarm config to %#v. Default is empty.", swarmConfig)
 
+	if len(workerVersion) == 0 {
+		workerVersion = "latest"
+		log.Printf("[INFO] SHUFFLE_WORKER_VERSION not defined. Defaulting to %#v", workerVersion)
+	}
+
 	// This is now always static
 	newWorker := fmt.Sprintf("ghcr.io/shuffle/shuffle-worker:%s", workerVersion)
 	if len(newWorkerImage) > 0 {

From af62013cbf629eb0a8513ee3fea12fff04b807c4 Mon Sep 17 00:00:00 2001
From: yashsinghcodes <yash9vardhan@gmail.com>
Date: Mon, 29 Jun 2026 11:20:49 +0530
Subject: [PATCH 25/25] fix: default tag worker fix (2)

---
 orborus.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/orborus.go b/orborus.go
index 3614138..a893ad2 100755
--- a/orborus.go
+++ b/orborus.go
@@ -2578,6 +2578,11 @@ func mainLoop() {
 
 	ctx := context.Background()
 	workerTimeout := 600
+	if len(workerVersion) == 0 {
+		workerVersion = "latest"
+		log.Printf("[INFO] SHUFFLE_WORKER_VERSION not defined. Defaulting to %#v", workerVersion)
+	}
+
 	workerImage := fmt.Sprintf("ghcr.io/shuffle/shuffle-worker:%s", workerVersion)
 	if len(newWorkerImage) > 0 {
 		workerImage = newWorkerImage