From 8d36dc2f9b47338d70d5775fd78077ffeba34073 Mon Sep 17 00:00:00 2001 From: Levalicious Date: Mon, 12 Oct 2026 17:18:15 -0400 Subject: [PATCH] ci: push images as the reweave-ci bot Gitea's registry refuses the job token (no package scope at login), so log in as reweave-ci with the org secret REGISTRY_TOKEN, and drop the packages permission that had no effect. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01UHXzGrsxfkGk8LmwrBbHNZ --- .gitea/workflows/images.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/images.yml b/.gitea/workflows/images.yml index b3fc155d..d72fe110 100644 --- a/.gitea/workflows/images.yml +++ b/.gitea/workflows/images.yml @@ -15,9 +15,10 @@ on: - "**.md" workflow_dispatch: +# The job token can't log in to the registry (no package scope there), so +# the push uses the reweave-ci bot's token from the org secret REGISTRY_TOKEN. permissions: contents: read - packages: write jobs: images: @@ -31,7 +32,7 @@ jobs: fetch-depth: 0 # tags, for the version string - name: Log in to the registry - run: echo "${{ secrets.GITEA_TOKEN }}" | docker login "$REGISTRY" -u "${{ gitea.actor }}" --password-stdin + run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "$REGISTRY" -u reweave-ci --password-stdin - name: Build and push (linux/amd64) run: |