cloud/project-manager
3
0
Fork 0
Code Issues Pull Requests Actions Packages Releases Activity

Fix container registry login: GITEA_TOKEN never grants package access #5

Merged
aneurin merged 1 commits from fix-registry-auth into main 2026-09-05 11:59:33 +00:00
Conversation 0 Commits 1 Files Changed 2
+16 -16
2 changed files with 16 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/build.yml
+8 -8
View File
@@ -10,18 +10,18 @@ name: Build
# This project's CI/CD scope is intentionally just test/build/push -- # This project's CI/CD scope is intentionally just test/build/push --
# deployment is being split into a separate project. # deployment is being split into a separate project.
# #
# Requires secrets.GITEA_TOKEN (auto-injected by Gitea Actions; needs the # Requires secrets.CONTAINER_REGISTRY_PASSWORD -- a personal access token
# "packages" permission scope to push images). # (write:package scope) from the pushing account, stored manually as a repo
# secret. The auto-injected secrets.GITEA_TOKEN does NOT work for this: it
# never grants package-registry access regardless of the workflow's own
# `permissions:` block -- a known Gitea limitation, not a config mistake
# (https://github.com/go-gitea/gitea/issues/23642).
on: on:
push: push:
branches: [main] branches: [main]
workflow_dispatch: workflow_dispatch:
permissions:
contents: read
packages: write
jobs: jobs:
build-and-push: build-and-push:
runs-on: ubuntu-latest runs-on: ubuntu-latest
@@ -42,8 +42,8 @@ jobs:
- name: Log in to the container registry - name: Log in to the container registry
env: env:
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }} CONTAINER_REGISTRY_PASSWORD: ${{ secrets.CONTAINER_REGISTRY_PASSWORD }}
run: echo "$GITEA_TOKEN" | docker login code.aneur.in -u "${{ gitea.actor }}" --password-stdin run: echo "$CONTAINER_REGISTRY_PASSWORD" | docker login code.aneur.in -u "${{ gitea.actor }}" --password-stdin
- name: Promote the current "latest" to "previous" - name: Promote the current "latest" to "previous"
run: | run: |
.gitea/workflows/release.yml
+8 -8
View File
@@ -10,17 +10,17 @@ name: Release
# Assumes tags are cut from commits already on main (and so already covered # Assumes tags are cut from commits already on main (and so already covered
# by ci.yml's checks) -- this workflow doesn't run the test suite itself. # by ci.yml's checks) -- this workflow doesn't run the test suite itself.
# #
# Requires secrets.GITEA_TOKEN (auto-injected; needs the "packages" # Requires secrets.CONTAINER_REGISTRY_PASSWORD -- a personal access token
# permission scope to push images). # (write:package scope) from the pushing account, stored manually as a repo
# secret. The auto-injected secrets.GITEA_TOKEN does NOT work for this: it
# never grants package-registry access regardless of the workflow's own
# `permissions:` block -- a known Gitea limitation, not a config mistake
# (https://github.com/go-gitea/gitea/issues/23642).
on: on:
push: push:
tags: ['*'] tags: ['*']
permissions:
contents: read
packages: write
jobs: jobs:
build-and-push: build-and-push:
runs-on: ubuntu-latest runs-on: ubuntu-latest
@@ -40,8 +40,8 @@ jobs:
- name: Log in to the container registry - name: Log in to the container registry
env: env:
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }} CONTAINER_REGISTRY_PASSWORD: ${{ secrets.CONTAINER_REGISTRY_PASSWORD }}
run: echo "$GITEA_TOKEN" | docker login code.aneur.in -u "${{ gitea.actor }}" --password-stdin run: echo "$CONTAINER_REGISTRY_PASSWORD" | docker login code.aneur.in -u "${{ gitea.actor }}" --password-stdin
- name: Build and push the image - name: Build and push the image
run: | run: |