assafelovic · TheSpaceGod · Jan 28, 2026 · Jan 28, 2026 · Jan 28, 2026
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -18,6 +18,7 @@ on:
 env:
     AWS_REGION: us-east-1
     TF_VAR_image_tag: us-east-1
+    TF_VAR_image_repository: ghcr.io/${{ github.repository }}
     REPO_FULL_NAME: ${{ github.repository }}
 
 jobs:
@@ -117,6 +118,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
+      packages: read
 
     steps:
     - name: Checkout code
@@ -174,6 +176,7 @@ jobs:
             echo "Using fallback image tag: ${IMAGE_TAG}"
           fi
         fi
+
     - name: Setup Terraform
       uses: hashicorp/setup-terraform@v3
       with:

diff --git a/.github/workflows/docker-push.yml b/.github/workflows/docker-push.yml
@@ -84,15 +84,26 @@ jobs:
         with:
           username: "${{ env.DOCKER_USERNAME }}"
           password: "${{ env.DOCKER_TOKEN }}"
+
+      - name: "Prepare target images"
+        id: target-images
+        run: |
+          IMAGES="ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME_GHCR_SUFFIXED }}"
+          if [[ "${{ env.DOCKERHUB_AUTH }}" == "true" ]]; then
+            IMAGES="${IMAGES}
+            ${{ env.DOCKER_USERNAME }}/${{ env.IMAGE_NAME_DOCKERHUB_SUFFIXED }}"
+          fi
+          echo "images<<EOF" >> $GITHUB_OUTPUT
+          echo "$IMAGES" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
       - name: "Extract Docker metadata"
         id: "meta"
         uses: "docker/metadata-action@v5"
         # This line makes it possible to cancel a workflow in the middle of a step. Otherwise the step needs to complete first.
         if: ${{ success() || failure() }}
         with:
-          images: |
-            ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME_GHCR_SUFFIXED }}
-            ${{ env.DOCKER_USERNAME }}/${{ env.IMAGE_NAME_DOCKERHUB_SUFFIXED }}
+          images: ${{ steps.target-images.outputs.images }}
           tags: |
             # For release tags: apply the version tag and mark as latest
             type=semver,pattern={{version}}
@@ -103,6 +114,8 @@ jobs:
             type=ref,event=branch,prefix=
             # For PRs: apply pr-{number} tag
             type=ref,event=pr
+            # For commits: apply sha tag
+            type=sha
       - name: "Build and push Docker image"
         uses: "docker/build-push-action@v6"
         # This line makes it possible to cancel a workflow in the middle of a step. Otherwise the step needs to complete first.
@@ -113,7 +126,7 @@ jobs:
           platforms: "linux/amd64,linux/arm64"
           tags: "${{ steps.meta.outputs.tags }}"
           labels: "${{ steps.meta.outputs.labels }}"
-          push: true
+          push: ${{ github.event_name != 'pull_request' }}
           provenance: false
           sbom: false
           cache-from: "type=gha"
@@ -178,15 +191,26 @@ jobs:
         with:
           username: "${{ env.DOCKER_USERNAME }}"
           password: "${{ env.DOCKER_TOKEN }}"
+
+      - name: "Prepare target images"
+        id: target-images
+        run: |
+          IMAGES="ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME_GHCR_SUFFIXED }}"
+          if [[ "${{ env.DOCKERHUB_AUTH }}" == "true" ]]; then
+            IMAGES="${IMAGES}
+            ${{ env.DOCKER_USERNAME }}/${{ env.IMAGE_NAME_DOCKERHUB_SUFFIXED }}"
+          fi
+          echo "images<<EOF" >> $GITHUB_OUTPUT
+          echo "$IMAGES" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
       - name: "Extract Docker metadata"
         id: "meta"
         uses: "docker/metadata-action@v5"
         # This line makes it possible to cancel a workflow in the middle of a step. Otherwise the step needs to complete first.
         if: ${{ success() || failure() }}
         with:
-          images: |
-            ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME_GHCR_SUFFIXED }}
-            ${{ env.DOCKER_USERNAME }}/${{ env.IMAGE_NAME_DOCKERHUB_SUFFIXED }}
+          images: ${{ steps.target-images.outputs.images }}
           tags: |
             # For release tags: apply the version tag and mark as latest
             type=semver,pattern={{version}}
@@ -207,7 +231,7 @@ jobs:
           platforms: "linux/amd64,linux/arm64"
           tags: "${{ steps.meta.outputs.tags }}"
           labels: "${{ steps.meta.outputs.labels }}"
-          push: true
+          push: ${{ github.event_name != 'pull_request' }}
           provenance: false
           sbom: false
           cache-from: "type=gha"
@@ -272,15 +296,26 @@ jobs:
         with:
           username: "${{ env.DOCKER_USERNAME }}"
           password: "${{ env.DOCKER_TOKEN }}"
+
+      - name: "Prepare target images"
+        id: target-images
+        run: |
+          IMAGES="ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME_GHCR_SUFFIXED }}"
+          if [[ "${{ env.DOCKERHUB_AUTH }}" == "true" ]]; then
+            IMAGES="${IMAGES}
+            ${{ env.DOCKER_USERNAME }}/${{ env.IMAGE_NAME_DOCKERHUB_SUFFIXED }}"
+          fi
+          echo "images<<EOF" >> $GITHUB_OUTPUT
+          echo "$IMAGES" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
       - name: "Extract Docker metadata"
         id: "meta"
         uses: "docker/metadata-action@v5"
         # This line makes it possible to cancel a workflow in the middle of a step. Otherwise the step needs to complete first.
         if: ${{ success() || failure() }}
         with:
-          images: |
-            ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME_GHCR_SUFFIXED }}
-            ${{ env.DOCKER_USERNAME }}/${{ env.IMAGE_NAME_DOCKERHUB_SUFFIXED }}
+          images: ${{ steps.target-images.outputs.images }}
           tags: |
             # For release tags: apply the version tag and mark as latest
             type=semver,pattern={{version}}
@@ -301,7 +336,7 @@ jobs:
           platforms: "linux/amd64,linux/arm64"
           tags: "${{ steps.meta.outputs.tags }}"
           labels: "${{ steps.meta.outputs.labels }}"
-          push: true
+          push: ${{ github.event_name != 'pull_request' }}
           provenance: false
           sbom: false
           cache-from: "type=gha"
@@ -366,15 +401,26 @@ jobs:
         with:
           username: "${{ env.DOCKER_USERNAME }}"
           password: "${{ env.DOCKER_TOKEN }}"
+
+      - name: "Prepare target images"
+        id: target-images
+        run: |
+          IMAGES="ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME_GHCR_SUFFIXED }}"
+          if [[ "${{ env.DOCKERHUB_AUTH }}" == "true" ]]; then
+            IMAGES="${IMAGES}
+            ${{ env.DOCKER_USERNAME }}/${{ env.IMAGE_NAME_DOCKERHUB_SUFFIXED }}"
+          fi
+          echo "images<<EOF" >> $GITHUB_OUTPUT
+          echo "$IMAGES" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
       - name: "Extract Docker metadata"
         id: "meta"
         uses: "docker/metadata-action@v5"
         # This line makes it possible to cancel a workflow in the middle of a step. Otherwise the step needs to complete first.
         if: ${{ success() || failure() }}
         with:
-          images: |
-            ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME_GHCR_SUFFIXED }}
-            ${{ env.DOCKER_USERNAME }}/${{ env.IMAGE_NAME_DOCKERHUB_SUFFIXED }}
+          images: ${{ steps.target-images.outputs.images }}
           tags: |
             # For release tags: apply the version tag and mark as latest
             type=semver,pattern={{version}}
@@ -395,8 +441,36 @@ jobs:
           platforms: "linux/amd64,linux/arm64"
           tags: "${{ steps.meta.outputs.tags }}"
           labels: "${{ steps.meta.outputs.labels }}"
-          push: true
+          push: ${{ github.event_name != 'pull_request' }}
           provenance: false
           sbom: false
           cache-from: "type=gha"
           cache-to: "type=gha,mode=max"
+
+  verify-images:
+    name: "Verify Root Image"
+    # This line makes it possible to cancel a workflow in the middle of a step. Otherwise the step needs to complete first.
+    if: ${{ (success() || failure()) && github.event_name != 'pull_request' }}
+    needs: build-push-root
+    runs-on: "ubuntu-latest"
+    steps:
+      - name: "Log in to GitHub Container Registry"
+        uses: "docker/login-action@v3"
+        with:
+          registry: "ghcr.io"
+          username: "${{ github.repository_owner }}"
+          password: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: "Pull and Verify Image"
+        run: |
+          # Calculate short SHA to match the tag generated by metadata-action
+          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+          IMAGE_TAG="sha-${SHORT_SHA}"
+          IMAGE_NAME="ghcr.io/${{ github.repository }}:${IMAGE_TAG}"
+
+          echo "Pulling image: ${IMAGE_NAME}"
+          docker pull "${IMAGE_NAME}"
+
+          echo "Verifying image..."
+          # Just check if python is available as a basic check
+          docker run --rm "${IMAGE_NAME}" python --version
diff --git a/README.md b/README.md
@@ -13,6 +13,7 @@
 ![GitHub Release](https://img.shields.io/github/v/release/assafelovic/gpt-researcher?style=flat&logo=github)
 [![Open In Colab](https://img.shields.io/static/v1?message=Open%20in%20Colab&logo=googlecolab&labelColor=grey&color=yellow&label=%20&style=flat&logoSize=40)](https://colab.research.google.com/github/assafelovic/gpt-researcher/blob/master/docs/docs/examples/pip-run.ipynb)
 [![Docker Image Version](https://img.shields.io/docker/v/elestio/gpt-researcher/latest?arch=amd64&style=flat&logo=docker&logoColor=white&color=1D63ED)](https://hub.docker.com/r/gptresearcher/gpt-researcher)
+[![GHCR Image](https://img.shields.io/badge/GHCR-gpt--researcher-blue?logo=github&logoColor=white)](https://github.com/assafelovic/gpt-researcher/pkgs/container/gpt-researcher)
 [![Twitter Follow](https://img.shields.io/twitter/follow/assaf_elovic?style=social)](https://twitter.com/assaf_elovic)
 
 [English](README.md) | [中文](README-zh_CN.md) | [日本語](README-ja_JP.md) | [한국어](README-ko_KR.md)
@@ -208,6 +209,14 @@ If that doesn't work, try running it without the dash:
 docker compose up --build
 ```
 
+### Pulling from GitHub Container Registry (GHCR)
+
+You can also pull the Docker image directly from GHCR:
+
+```bash
+docker pull ghcr.io/assafelovic/gpt-researcher:latest
+```
+
 > **Step 4** - By default, if you haven't uncommented anything in your docker-compose file, this flow will start 2 processes:
  - the Python server running on localhost:8000<br>
  - the React app running on localhost:3000<br>

diff --git a/terraform/main.tf b/terraform/main.tf
@@ -1,23 +1,3 @@
-# Remote state to pull ECR repository details managed in terraform/ecr-setup
-data "terraform_remote_state" "ecr" {
-  backend = "s3"
-
-  config = {
-    bucket         = "gg-ai-terraform-states"
-    key            = "production/gpt-researcher/ecr.tfstate"
-    region         = "us-east-1"
-    dynamodb_table = "terraform-state-locks"
-    encrypt        = true
-  }
-}
-locals {
-  # Remote ECR url is preferred; fall back to live lookup only when missing
-  use_remote_ecr_url = try(data.terraform_remote_state.ecr.outputs.ecr_repository_url != "", false)
-}
-data "aws_ecr_repository" "app" {
-  count = local.use_remote_ecr_url ? 0 : 1
-  name  = var.ecr_repository_name != "" ? var.ecr_repository_name : var.project_name
-}
 data "aws_secretsmanager_secret" "openwebui_secret_manager" {
   name = var.openwebui_secret_manager
 }
@@ -36,14 +16,10 @@ locals {
   service_name = var.project_name
   environment  = var.environment
 
-  # ECR configuration
-  ecr_repository_name = local.service_name
-  image_tag           = var.image_tag
-  # Prefer remote state output but fall back to querying the repository directly
-  ecr_repository_url = try(
-    data.terraform_remote_state.ecr.outputs.ecr_repository_url,
-    data.aws_ecr_repository.app[0].repository_url,
-  )
+  # Image configuration
+  image_tag = var.image_tag
+  # Use provided image repository or fall back to default
+  image_repository = var.image_repository
 
   # ECS configuration - using common module with validation
   ecs_cluster_name = module.common.available_clusters["general"]
@@ -152,7 +128,7 @@ module "ecs_service" {
   source = "git::https://github.com/Gravity-Global/gg-ai-terraform-common.git//modules/ecs-service?ref=main"
 
   service_name    = local.service_name
-  container_image = "${local.ecr_repository_url}:${var.image_tag}"
+  container_image = "${local.image_repository}:${var.image_tag}"
 
   container_port = local.container_port
   environment    = local.environment