Correct the registry auth docs: the Actions token does not work

docs/ci.md and the workflow comment both described secrets.GITHUB_TOKEN as the working credential with REGISTRY_TOKEN as a fallback. That is backwards: the task token is rejected by Gitea's container registry (go-gitea/gitea#23642) and the first publish attempt failed on exactly that. REGISTRY_TOKEN is required. Part of #187 Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01D9acV1mHktGAb1uyvNmrR2
2026-08-24 22:35:10 -03:00
parent c9d18fec74
commit f8762e1095
2 changed files with 18 additions and 8 deletions
@@ -62,9 +62,11 @@ jobs:
          fi
          docker version --format 'client {{.Client.Version}} / server {{.Server.Version}} / arch {{.Server.Arch}}'

-      # secrets.GITHUB_TOKEN is the Actions task token and can write packages
-      # for the repository owner. REGISTRY_TOKEN is an escape hatch: set it to
-      # a PAT with package:write if the task token is ever refused.
+      # REGISTRY_TOKEN (org secret, a PAT with the package scope) is what
+      # actually works. Gitea's Actions task token is rejected by the
+      # container registry — go-gitea/gitea#23642 — so the GITHUB_TOKEN
+      # fallback below only exists to keep this readable on an instance where
+      # that is ever fixed. See docs/ci.md.
      - name: Log in to the container registry
        if: github.event_name != 'pull_request'
        run: |