From b83f9e95b6f99d6167551aeba347296c4d7f955c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niels=20G=C3=B6ttsch?= <niels.goettsch@openfellas.com>
Date: Fri, 17 Jul 2026 10:02:15 +0200
Subject: [PATCH] ci: authenticate registry push with
 REGISTRY_USER/REGISTRY_TOKEN PAT

Forgejo's auto GITHUB_TOKEN lacks package-write on the moby org, so the
Kaniko push 401s (reqPackageAccess). Use the write:package PAT secrets
for the registry auth (matching moby/uberbau_xyz and moby/claude-code);
the git-context clone stays on the auto token.
---
 .github/workflows/deploy.yml | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 91d0f68..8382282 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -13,9 +13,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-# The auto GITHUB_TOKEN needs `packages: write` to push to the forge's container
-# registry — without it Kaniko's push-permission check 401s (reqPackageAccess).
-# `contents: read` keeps git clone (checkout / Kaniko git context) working.
+# The registry push uses a PAT with `write:package` scope, supplied via the
+# REGISTRY_USER / REGISTRY_TOKEN Actions secrets (same as moby/uberbau_xyz and
+# moby/claude-code). Forgejo's auto GITHUB_TOKEN lacks org package-write, so a
+# push authenticated with it 401s (reqPackageAccess). `contents: read` keeps the
+# Kaniko git-context clone (over the auto token) working; `packages: write` is
+# belt-and-suspenders on the auto token.
 permissions:
   contents: read
   packages: write
@@ -86,11 +89,11 @@ jobs:
     steps:
       - name: Build and push (Kaniko)
         env:
-          # Forgejo auto-provides GITHUB_TOKEN; it can push packages for this
-          # repo's owner (moby) and read this (private-context) git repo.
-          FORGE_USER: ${{ github.actor }}
-          FORGE_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # Kaniko reads these to clone the `--context` git URL.
+          # Registry push uses a PAT with write:package scope (Forgejo's auto
+          # GITHUB_TOKEN lacks org package-write -> 401 reqPackageAccess).
+          FORGE_USER: ${{ secrets.REGISTRY_USER }}
+          FORGE_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          # Kaniko clones the `--context` git URL over the auto token (read).
           GIT_USERNAME: ${{ github.actor }}
           GIT_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
         run: |