moby/brewlog
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ci: grant the job token packages:write for the registry push
Some checks failed
Build & Publish / Check (push) Successful in 7m40s
Details
Build & Publish / Build & Publish (push) Failing after 4s
Details

Browse source 
Kaniko's up-front push-permission check 401'd (reqPackageAccess): the Forgejo
auto GITHUB_TOKEN has no package-write scope by default. Declare
`permissions: {contents: read, packages: write}` so the token can push to the
forge container registry (git clone still needs contents:read).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Niels Göttsch 2026-07-16 18:09:32 +02:00
parent 423ddc7870
commit 2e55c72522
1 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
.github/workflows/deploy.yml vendored
View file

@ -13,6 +13,13 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
# The auto GITHUB_TOKEN needs `packages: write` to push to the forge's container
# registry — without it Kaniko's push-permission check 401s (reqPackageAccess).
# `contents: read` keeps git clone (checkout / Kaniko git context) working.
permissions:
contents: read
packages: write
env: env:
# This forge's built-in container registry, same host as the git server. # This forge's built-in container registry, same host as the git server.
REGISTRY: git.ziemlichoptimal.de REGISTRY: git.ziemlichoptimal.de