Use DOCKMV_TOKEN environment variable for authentication token

- Remove --token=auto flag from docker-compose
- Default token flag to $DOCKMV_TOKEN environment variable instead of empty string
- Update help text to document environment variable default

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

docker-compose.yml

@@ -9,11 +9,7 @@
 
 services:
   dockmv:
-    build:
+    image: git.azuze.fr/kawa/dockmv:${VERSION:-latest}
-      context: .
-      args:
-        VERSION: ${VERSION:-dev}
-    image: dockmv:latest
     container_name: dockmv
     restart: unless-stopped
     ports:
@@ -31,7 +27,6 @@ services:
     command:
       - serve
       - --addr=0.0.0.0:8080
-      - --token=auto
 
 volumes:
   migrate-data:

main.go

@@ -81,7 +81,7 @@ Run "dockmv serve -h" for the server flags.
 func serve(args []string) error {
 	fs := flag.NewFlagSet("serve", flag.ContinueOnError)
 	addr := fs.String("addr", "127.0.0.1:8080", "address to listen on; use 0.0.0.0:8080 to expose it on the network")
-	token := fs.String("token", "", "require this token on every request; \"auto\" generates one")
+	token := fs.String("token", os.Getenv("DOCKMV_TOKEN"), "require this token on every request; \"auto\" generates one (default: $DOCKMV_TOKEN)")
 	dataDir := fs.String("data-dir", defaultDataDir(), "directory for connections and trusted host keys")
 	pkgDir := fs.String("package-dir", "", "directory for migration packages (default <data-dir>/packages)")
 	dockerHost := fs.String("docker-host", "", "source docker daemon (default: the DOCKER_HOST environment)")

scripts/publish.ps1

@@ -10,11 +10,13 @@
 
     It also cross-compiles the release binaries (scripts/build-release.ps1) from
     the same commit, so both artifacts carry the same -Tag. Archives cannot live
-    in a container registry, so -PublishRelease attaches them to the Gitea
+    in a container registry, so they're attached to the Gitea release for that
-    release for that tag instead (creating the release if it does not exist).
+    tag instead (creating the release if it does not exist) — on by default,
+    since a run that builds binaries and doesn't publish them is the unusual
+    case. Pass -NoPublishRelease to build locally without uploading.
 
     -BinariesOnly ships just the binaries: no docker build, no docker login, no
-    image push, and the release upload is implied.
+    image push.
 
     Credentials are read, in order of precedence:
       1. -Username / -Password parameters
@@ -27,11 +29,12 @@
 
 .EXAMPLE
     ./scripts/publish.ps1
-    Build and push :latest plus the git-describe tag; build dist/ binaries locally.
+    Full release: push the image (:latest plus the git-describe tag) and attach
+    every dist/ archive to the matching Gitea release.
 
 .EXAMPLE
-    ./scripts/publish.ps1 -Tag v1.2.0 -PublishRelease
+    ./scripts/publish.ps1 -Tag v1.2.0 -NoPublishRelease
-    Full release: push the image and attach every dist/ archive to release v1.2.0.
+    Push the image and build dist/ binaries locally, but don't upload them.
 
 .EXAMPLE
     ./scripts/publish.ps1 -BinariesOnly -Tag v1.2.0
@@ -44,7 +47,7 @@
 
 .EXAMPLE
     ./scripts/publish.ps1 -NoBinaries
-    Container only — no cross-compile.
+    Container only — no cross-compile, nothing to publish as a release.
 
 .EXAMPLE
     $env:GITEA_USER = "kawa"; $env:GITEA_TOKEN = "xxxx"; ./scripts/publish.ps1 -SkipLogin:$false
@@ -96,13 +99,12 @@ param(
     # retrying a failed upload without paying for the build again.
     [switch]$NoBinaryBuild,
 
-    # Ship only the binaries: no docker build, login or push. Implies
+    # Ship only the binaries: no docker build, login or push.
-    # -PublishRelease, since building alone is what build-release.ps1 already does.
     [switch]$BinariesOnly,
 
-    # Attach the release archives to the Gitea release for $Tag, creating the
+    # Skip attaching the release archives to the Gitea release for $Tag. The
-    # release if it is missing.
+    # upload happens by default whenever binaries are built.
-    [switch]$PublishRelease,
+    [switch]$NoPublishRelease,
 
     # owner/repo holding the release. Defaults to $Owner/$Repo.
     [string]$ReleaseRepo,
@@ -282,15 +284,21 @@ try {
     if ($NoBinaryBuild -and $NoBinaries) {
         throw "-NoBinaryBuild reuses the build that -NoBinaries skips entirely — pick one."
     }
+    if ($BinariesOnly -and $NoPublishRelease) {
+        throw "-BinariesOnly with -NoPublishRelease leaves nothing to do — pick one."
+    }
     if ($BinariesOnly) {
         # Nothing to build, log into or push on the container side, and uploading
         # is the whole point (build-release.ps1 alone covers "just build them").
-        $NoBuild        = $true
+        $NoBuild   = $true
-        $SkipLogin      = $true
+        $SkipLogin = $true
-        $PublishRelease = $true
     }
     $pushImage = -not $BinariesOnly
 
+    # On by default: a run that builds binaries and doesn't publish them is the
+    # unusual case. -NoBinaries means there is nothing to publish either way.
+    $PublishRelease = (-not $NoPublishRelease) -and (-not $NoBinaries)
+
     if (-not $ReleaseRepo) { $ReleaseRepo = "$Owner/$Repo" }
     if (-not $ApiBase)     { $ApiBase = "https://$Registry" }
     $apiRoot = "$($ApiBase.TrimEnd('/'))/api/v1"
@@ -415,7 +423,7 @@ try {
     $releaseUrl = $null
     if ($PublishRelease) {
         if (-not $artifacts.Count) {
-            throw "-PublishRelease has nothing to upload (was -NoBinaries set?)."
+            throw "nothing to upload — no release archives were built (was -NoBinaries set?)."
         }
         Write-Host "Uploading binaries to release $Tag..." -ForegroundColor Cyan
         $Password   = Resolve-Token -Provided $Password -Purpose "release upload to $ReleaseRepo"