Correct the registry auth docs: the Actions token does not work

docs/ci.md and the workflow comment both described secrets.GITHUB_TOKEN as the working credential with REGISTRY_TOKEN as a fallback. That is backwards: the task token is rejected by Gitea's container registry (go-gitea/gitea#23642) and the first publish attempt failed on exactly that. REGISTRY_TOKEN is required. Part of #187 Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01D9acV1mHktGAb1uyvNmrR2
2026-08-24 22:35:10 -03:00
parent c9d18fec74
commit f8762e1095
2 changed files with 18 additions and 8 deletions
@@ -66,9 +66,17 @@ one of a different architecture ever joins, it will overwrite these tags with
 its own arch and the rest will fail to pull — at which point the build needs
 `docker buildx` and a multi-arch manifest.

-## If a push is refused
+## Registry authentication

-The build authenticates with `secrets.GITHUB_TOKEN`, the Actions task token.
-If the registry ever refuses it, create a personal access token with
-`package:write`, store it as the `REGISTRY_TOKEN` secret, and optionally set
-the `REGISTRY_USER` variable — the workflow prefers both when present.
+The build pushes with the `REGISTRY_TOKEN` secret, set at the organisation
+level. **This is required, not optional.** Gitea's Actions task token
+(`secrets.GITHUB_TOKEN`) is rejected by the container registry —
+`docker login` fails with `Get "https://git.unsupervised.ca/v2/":
+unauthorized`. That is [go-gitea/gitea#23642][], open since 2023.
+
+`REGISTRY_TOKEN` is a personal access token with the `package` scope, Read
+and Write. The workflow logs in as `github.actor`, which must be the account
+that owns the token; if it ever needs to differ, set a `REGISTRY_USER`
+variable and the workflow will prefer it.
+
+[go-gitea/gitea#23642]: https://github.com/go-gitea/gitea/issues/23642