From 2e55c72522ba20524cdecbea34fd596881fd3859 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Niels=20G=C3=B6ttsch?= Date: Thu, 16 Jul 2026 18:09:32 +0200 Subject: [PATCH] ci: grant the job token packages:write for the registry push Kaniko's up-front push-permission check 401'd (reqPackageAccess): the Forgejo auto GITHUB_TOKEN has no package-write scope by default. Declare `permissions: {contents: read, packages: write}` so the token can push to the forge container registry (git clone still needs contents:read). Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/deploy.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index db5db21..2d67d4e 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -13,6 +13,13 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +# The auto GITHUB_TOKEN needs `packages: write` to push to the forge's container +# registry — without it Kaniko's push-permission check 401s (reqPackageAccess). +# `contents: read` keeps git clone (checkout / Kaniko git context) working. +permissions: + contents: read + packages: write + env: # This forge's built-in container registry, same host as the git server. REGISTRY: git.ziemlichoptimal.de