ci(publish): compose the registry URL from a base and the repository owner

charts-url in op://GitHub-Actions/jlab-registry-access held the full
registry URL and publish-helm-chart.yml appended /api/charts to it. It
now holds only the base up to /api/packages, and the owner segment comes
from github.repository_owner, so the target is composed as
<base>/<owner>/helm/api/charts.

Nothing in this repository points at the registry any more, not even a
path segment, and the second owner on the same instance needs no second
setting. The 26 thin publish-<chart>.yml callers are unchanged.

Two guards keep the switch from the old shape loud rather than a 404
against a masked URL: charts-url is rejected unless it ends in
/api/packages, naming /helm, /api/charts or an included owner
explicitly; and the derived owner is rejected when empty or when it is
not a usable URL path segment. Everything the upload step already had
is untouched - the per-field :? guards, the whitespace check on the
credentials, the host masking, the built file name, --fail-with-body.

The probe step in validate-charts.yml is temporary and measures whether
this forge populates github.repository_owner at all; it is removed again
once the value has been read off the run.

.github/workflows/publish-helm-chart.yml

@@ -74,9 +74,26 @@ jobs:
           REGISTRY_CHARTS_URL: op://GitHub-Actions/jlab-registry-access/charts-url
       # The target is a classic, index-based Helm registry, not an OCI one, so
       # there is no "helm registry login" session and no "helm push": the upload
-      # is a single HTTP POST of the packaged .tgz to <charts-url>/api/charts,
-      # authenticated per request. Three properties of this step are load-bearing
-      # and each of them was paid for once already.
+      # is a single HTTP POST of the packaged .tgz to
+      # <charts-url>/<owner>/helm/api/charts, authenticated per request.
+      #
+      # That URL is composed, not stored (#63). charts-url holds only the base
+      # up to "/api/packages"; the owner segment comes from
+      # github.repository_owner, so no value pointing at the registry - not even
+      # a path segment - lives in this repository, and a second owner on the same
+      # instance needs no second setting. The mirror on github.com has Actions
+      # switched off, so the publish never runs there; if it ever did, the
+      # derived owner would be one the instance does not know and the upload
+      # would 404 rather than land somewhere wrong. Two guards make the switch
+      # from the old shape loud instead of puzzling: charts-url is rejected
+      # unless it ends in "/api/packages" (an old full URL still carrying
+      # "/helm", "/api/charts" or the owner is named explicitly), and the derived
+      # owner is rejected when empty or when it holds characters that are not a
+      # path segment - an empty one would build "<base>//helm/api/charts", i.e.
+      # another bare 404 against a masked URL.
+      #
+      # Three further properties of this step are load-bearing and each of them
+      # was paid for once already.
       #
       # 1) The values are mapped into the step's own env block and read as quoted
       # shell variables - never interpolated into the command line. load-secrets-
@@ -114,18 +131,49 @@ jobs:
           REGISTRY_PASSWORD: ${{ steps.load-registry-creds.outputs.REGISTRY_PASSWORD }}
           REGISTRY_USERNAME: ${{ steps.load-registry-creds.outputs.REGISTRY_USERNAME }}
           REGISTRY_CHARTS_URL: ${{ steps.load-registry-creds.outputs.REGISTRY_CHARTS_URL }}
+          REGISTRY_OWNER: ${{ github.repository_owner }}
           CHART_NAME: ${{ inputs.chart-name }}
           CHART_VERSION: ${{ steps.get-chart-version.outputs.CHART_VERSION }}
         run: |-
           : "${REGISTRY_CHARTS_URL:?empty - check op://GitHub-Actions/jlab-registry-access/charts-url}"
           : "${REGISTRY_USERNAME:?empty - check op://GitHub-Actions/jlab-registry-access/username}"
           : "${REGISTRY_PASSWORD:?empty - check op://GitHub-Actions/jlab-registry-access/password}"
+          : "${REGISTRY_OWNER:?empty - github.repository_owner is not populated on this forge; do not hardcode an owner, report it}"
           : "${CHART_NAME:?empty - the chart-name input did not arrive}"
           : "${CHART_VERSION:?empty - could not read version: from ${CHART_NAME}/Chart.yaml}"
           # 1Password masks the full URL, but a curl connection error prints only
           # "<host>:<port>", which that mask would not cover. Mask the host too.
           CHARTS_HOST="${REGISTRY_CHARTS_URL#*://}"
           echo "::add-mask::${CHARTS_HOST%%/*}"
+          # charts-url is the base only; this workflow appends the owner, the
+          # package type and the endpoint. Reject the old, full shape by name so
+          # the failure says what to change in the vault item instead of 404ing
+          # against a URL the log has masked.
+          CHARTS_BASE="${REGISTRY_CHARTS_URL%/}"
+          case "$CHARTS_BASE" in
+            */api/charts)
+              echo "::error::op://GitHub-Actions/jlab-registry-access/charts-url still ends in /api/charts - it must hold only the base up to /api/packages (https://<host>/api/packages); this workflow appends /<owner>/helm/api/charts itself"
+              exit 1
+              ;;
+            */helm|*/helm/*)
+              echo "::error::op://GitHub-Actions/jlab-registry-access/charts-url still contains the /helm path segment - it must hold only the base up to /api/packages (https://<host>/api/packages); this workflow appends /<owner>/helm/api/charts itself"
+              exit 1
+              ;;
+            */api/packages) ;;
+            *)
+              echo "::error::op://GitHub-Actions/jlab-registry-access/charts-url must end in /api/packages (https://<host>/api/packages) - no owner, no package type, no endpoint; this workflow appends /<owner>/helm/api/charts itself"
+              exit 1
+              ;;
+          esac
+          # An empty owner would build "<base>//helm/api/charts", a stray "/" or
+          # "?" would build something else entirely - both are bare 404s.
+          case "$REGISTRY_OWNER" in
+            *[!A-Za-z0-9._-]*)
+              echo "::error::the derived repository owner is not usable as a URL path segment: '${REGISTRY_OWNER}'"
+              exit 1
+              ;;
+          esac
+          CHARTS_API_URL="${CHARTS_BASE}/${REGISTRY_OWNER}/helm/api/charts"
           case "${REGISTRY_USERNAME}${REGISTRY_PASSWORD}" in
             *[[:space:]]*)
               echo "::error::username/password in op://GitHub-Actions/jlab-registry-access must not contain whitespace - curl --config truncates an unquoted value at the first space"
@@ -139,7 +187,7 @@ jobs:
           }
           echo "uploading ${CHART_PACKAGE}"
           printf 'user = %s:%s\nurl = %s\n' \
-            "$REGISTRY_USERNAME" "$REGISTRY_PASSWORD" "${REGISTRY_CHARTS_URL%/}/api/charts" |
+            "$REGISTRY_USERNAME" "$REGISTRY_PASSWORD" "$CHARTS_API_URL" |
             curl --config - \
                  --fail-with-body \
                  --silent --show-error \

.github/workflows/validate-charts.yml

@@ -14,6 +14,16 @@ jobs:
       install-charts: ${{ steps.detect.outputs.install-charts }}
       any-install: ${{ steps.detect.outputs.any-install }}
     steps:
+      # TEMPORARY (#63) - remove before the PR is merged. Measures whether this
+      # forge populates github.repository_owner at all; the publish URL is about
+      # to be composed from it.
+      - name: "TEMPORARY (#63): probe github.repository_owner"
+        env:
+          PROBE_OWNER: ${{ github.repository_owner }}
+        run: |
+          echo "github.repository_owner = [${PROBE_OWNER}]"
+          echo "github.repository       = [${{ github.repository }}]"
+          echo "length = ${#PROBE_OWNER}"
       - name: "Checkout Repository"
         uses: actions/checkout@v7
         with: