From f8762e1095943a3b2c725c95c36fbc9fd29d590b Mon Sep 17 00:00:00 2001 From: James Griffin Date: Mon, 24 Aug 2026 22:35:10 -0300 Subject: [PATCH] Correct the registry auth docs: the Actions token does not work docs/ci.md and the workflow comment both described secrets.GITHUB_TOKEN as the working credential with REGISTRY_TOKEN as a fallback. That is backwards: the task token is rejected by Gitea's container registry (go-gitea/gitea#23642) and the first publish attempt failed on exactly that. REGISTRY_TOKEN is required. Part of #187 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01D9acV1mHktGAb1uyvNmrR2 --- .gitea/workflows/ci-images.yml | 8 +++++--- docs/ci.md | 18 +++++++++++++----- 2 files changed, 18 insertions(+), 8 deletions(-) diff --git a/.gitea/workflows/ci-images.yml b/.gitea/workflows/ci-images.yml index 7dbeb2b..2af1028 100644 --- a/.gitea/workflows/ci-images.yml +++ b/.gitea/workflows/ci-images.yml @@ -62,9 +62,11 @@ jobs: fi docker version --format 'client {{.Client.Version}} / server {{.Server.Version}} / arch {{.Server.Arch}}' - # secrets.GITHUB_TOKEN is the Actions task token and can write packages - # for the repository owner. REGISTRY_TOKEN is an escape hatch: set it to - # a PAT with package:write if the task token is ever refused. + # REGISTRY_TOKEN (org secret, a PAT with the package scope) is what + # actually works. Gitea's Actions task token is rejected by the + # container registry — go-gitea/gitea#23642 — so the GITHUB_TOKEN + # fallback below only exists to keep this readable on an instance where + # that is ever fixed. See docs/ci.md. - name: Log in to the container registry if: github.event_name != 'pull_request' run: | diff --git a/docs/ci.md b/docs/ci.md index e9978b6..8beadc7 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -66,9 +66,17 @@ one of a different architecture ever joins, it will overwrite these tags with its own arch and the rest will fail to pull — at which point the build needs `docker buildx` and a multi-arch manifest. -## If a push is refused +## Registry authentication -The build authenticates with `secrets.GITHUB_TOKEN`, the Actions task token. -If the registry ever refuses it, create a personal access token with -`package:write`, store it as the `REGISTRY_TOKEN` secret, and optionally set -the `REGISTRY_USER` variable — the workflow prefers both when present. +The build pushes with the `REGISTRY_TOKEN` secret, set at the organisation +level. **This is required, not optional.** Gitea's Actions task token +(`secrets.GITHUB_TOKEN`) is rejected by the container registry — +`docker login` fails with `Get "https://git.unsupervised.ca/v2/": +unauthorized`. That is [go-gitea/gitea#23642][], open since 2023. + +`REGISTRY_TOKEN` is a personal access token with the `package` scope, Read +and Write. The workflow logs in as `github.actor`, which must be the account +that owns the token; if it ever needs to differ, set a `REGISTRY_USER` +variable and the workflow will prefer it. + +[go-gitea/gitea#23642]: https://github.com/go-gitea/gitea/issues/23642