From 7c6bc94f6f846ac6cd613559c024cd288b852c5a Mon Sep 17 00:00:00 2001 From: Alphaeus Mote Date: Wed, 2 Sep 2026 07:16:17 -0400 Subject: [PATCH] ci: use github.token for registry login and release, add package permissions The first run failed at docker login with 'unauthorized': secrets.GITEA_TOKEN is not populated on this instance, so the registry password was empty. Switch the registry login and release creation to github.token (always injected) and add an explicit permissions block granting contents+packages write. Co-Authored-By: Claude Opus 4.8 --- .gitea/workflows/release.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index f6b5a26..40586d1 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -25,6 +25,12 @@ jobs: # sibling repos use for their image jobs. runs-on: ubuntu-host + # Grant the auto-injected Actions token the scopes this job needs: push to + # the built-in container registry (packages) and create a release (contents). + permissions: + contents: write + packages: write + env: # Optional EXTERNAL registry override. Leave these unset to publish to the # Gitea instance's own built-in container registry (the default below). @@ -32,8 +38,9 @@ jobs: REGISTRY_USER: ${{ secrets.REGISTRY_USERNAME }} REGISTRY_PASS: ${{ secrets.REGISTRY_PASSWORD }} # Injected automatically by Gitea Actions; used for the built-in registry - # login and for creating the release. No manual secret needed. - BUILTIN_TOKEN: ${{ secrets.GITEA_TOKEN }} + # login and for creating the release. github.token is always populated + # (unlike secrets.GITEA_TOKEN, which is not defined on every instance). + BUILTIN_TOKEN: ${{ github.token }} SERVER_URL: ${{ github.server_url }} ACTOR: ${{ github.actor }} OWNER: ${{ github.repository_owner }} @@ -167,7 +174,7 @@ jobs: env: API_URL: ${{ github.api_url }} REPO: ${{ github.repository }} - TOKEN: ${{ secrets.GITEA_TOKEN }} + TOKEN: ${{ github.token }} VERSION: ${{ steps.ver.outputs.version }} GIT_COMMIT: ${{ steps.ver.outputs.git_commit }} GIT_COMMIT_SHORT: ${{ steps.ver.outputs.git_commit_short }} -- 2.52.0