From 30859703d2c4a6456e5d80586d4d1948206763d7 Mon Sep 17 00:00:00 2001 From: Thom Lamb Date: Sun, 30 Aug 2026 16:32:19 -0500 Subject: [PATCH] spike(ci): authenticate with a package-scoped PAT instead of the Actions token (#237) Iteration 2 got as far as the registry and was refused with a 401, not a certificate error, which established that everything except the credential already worked: the docker CLI installs, the daemon is reachable through the mounted socket, the container registry answers on /v2/, and TLS to the Gitea host is trusted from the runner. The token Actions injects automatically is scoped for the repository API and is not accepted by the package registry. This switches to REGISTRY_TOKEN, a personal access token carrying write:package, which is the one thing the workflow could not arrange for itself. Ref #237 --- .gitea/workflows/spike-registry.yml | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/.gitea/workflows/spike-registry.yml b/.gitea/workflows/spike-registry.yml index c6adb60..d6f48fb 100644 --- a/.gitea/workflows/spike-registry.yml +++ b/.gitea/workflows/spike-registry.yml @@ -85,20 +85,26 @@ jobs: echo "--- can it reach the daemon through the socket? ---" docker info --format 'server {{.ServerVersion}}, {{.Driver}}, {{.Architecture}}' - # Reported as a boolean, never printed. If this says NO, the login below - # will fail and the fix is to add the secret, not to change the workflow. + # REGISTRY_TOKEN, not GITEA_TOKEN. Iteration 2 established that the token + # Actions injects automatically is scoped for the repository API and is + # refused by the package registry — the login failed with a 401, not a + # certificate error, so everything except the credential was already + # working. This is a personal access token carrying write:package. + # + # Reported as a boolean and never printed. If this says EMPTY the fix is + # the secret, not the workflow. - name: Is a token available? continue-on-error: true run: | - if [ -n "${{ secrets.GITEA_TOKEN }}" ]; then - echo "GITEA_TOKEN is present" + if [ -n "${{ secrets.REGISTRY_TOKEN }}" ]; then + echo "REGISTRY_TOKEN is present" else - echo "GITEA_TOKEN is EMPTY — add a repo secret with package write scope" + echo "REGISTRY_TOKEN is EMPTY — add a repo secret holding a PAT with write:package" fi - name: Question 2a — log in to the registry run: | - echo "${{ secrets.GITEA_TOKEN }}" \ + echo "${{ secrets.REGISTRY_TOKEN }}" \ | docker login "$REGISTRY" -u "${{ github.actor }}" --password-stdin # A trivial image first, deliberately. It separates "can this runner build