moby/brewlog
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ci: authenticate registry push with REGISTRY_USER/REGISTRY_TOKEN PAT
Some checks failed
Build & Publish / Check (push) Successful in 2m18s
Details
Build & Publish / Build & Publish (push) Failing after 6m51s
Details

Browse source 
Forgejo's auto GITHUB_TOKEN lacks package-write on the moby org, so the
Kaniko push 401s (reqPackageAccess). Use the write:package PAT secrets
for the registry auth (matching moby/uberbau_xyz and moby/claude-code);
the git-context clone stays on the auto token.
This commit is contained in:
Niels Göttsch 2026-07-17 10:02:15 +02:00
parent 1ea007d330
commit b83f9e95b6
1 changed files with 11 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
.github/workflows/deploy.yml vendored
View file

@ -13,9 +13,12 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
# The auto GITHUB_TOKEN needs `packages: write` to push to the forge's container # The registry push uses a PAT with `write:package` scope, supplied via the
# registry — without it Kaniko's push-permission check 401s (reqPackageAccess). # REGISTRY_USER / REGISTRY_TOKEN Actions secrets (same as moby/uberbau_xyz and
# `contents: read` keeps git clone (checkout / Kaniko git context) working. # moby/claude-code). Forgejo's auto GITHUB_TOKEN lacks org package-write, so a
# push authenticated with it 401s (reqPackageAccess). `contents: read` keeps the
# Kaniko git-context clone (over the auto token) working; `packages: write` is
# belt-and-suspenders on the auto token.
permissions: permissions:
contents: read contents: read
packages: write packages: write
@ -86,11 +89,11 @@ jobs:
steps: steps:
- name: Build and push (Kaniko) - name: Build and push (Kaniko)
env: env:
# Forgejo auto-provides GITHUB_TOKEN; it can push packages for this # Registry push uses a PAT with write:package scope (Forgejo's auto
# repo's owner (moby) and read this (private-context) git repo. # GITHUB_TOKEN lacks org package-write -> 401 reqPackageAccess).
FORGE_USER: ${{ github.actor }} FORGE_USER: ${{ secrets.REGISTRY_USER }}
FORGE_TOKEN: ${{ secrets.GITHUB_TOKEN }} FORGE_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
# Kaniko reads these to clone the `--context` git URL. # Kaniko clones the `--context` git URL over the auto token (read).
GIT_USERNAME: ${{ github.actor }} GIT_USERNAME: ${{ github.actor }}
GIT_PASSWORD: ${{ secrets.GITHUB_TOKEN }} GIT_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
run: | run: |