you mean ghcr?

ghcr.io

Package visibility for github is private by default, Made it public, working now. Do you know of any security concerns around that since the railway postgres action uses a PAT token on build?

As a side note, would be great to keep the minimal postgres image, but also have a postgres image out of the box from railway with more popular extensions
https://neon.tech/docs/extensions/pg-extensions
https://supabase.com/docs/guides/database/extensions

I'm not sure what you mean when you mentioned a pat token on build?