ci: log in to the container registry as fmartingr (FMG-5) #10

Merged

fmartingr merged 1 commit from agent/full-stack-developer/2eb2e7f9a55d into main

2026-09-08 18:54:47 +02:00

butterrobot commented

2026-09-08 18:52:58 +02:00

Collaborator

The release job authenticated to git.nakama.town as ${{ github.actor }}. Tags are now pushed by the bot account butterrobot, so that resolved to butterrobot — which holds collaborator rights on the repository but not write access to the container packages under git.nakama.town/fmartingr/, since package permissions belong to the owning user rather than the repo. GoReleaser built fine and then died on push with 401 Unauthorized: reqPackageAccess.

That was hard to read off the logs, because the login step reported Login Succeeded either way: Forgejo's /v2/token hands out an anonymous token when the credential is not authorized, so docker login has nothing to fail on.

The username is now fixed to fmartingr, with a comment recording why it is not derived from the actor.

Still needs confirming by hand

FORGEJO_TOKEN must be a token owned by fmartingr carrying the write:package scope. If it belongs to butterrobot, this change alone will not fix the push.

I could not verify this: Forgejo never returns a secret's value, owner, or scopes through the API, and the credential available to this run is butterrobot, which is not the repo owner (tea actions secrets list → user should be the owner of the repo). It needs checking in the repository's Actions settings.

Validation

The change is CI configuration only — no Go code is touched. I verified the workflow YAML still parses and that the login step resolves to the intended command; no Go toolchain is available in this environment, so the repo's format/lint/test/build/goreleaser-lint targets were not run locally. CI covers them on this PR.

Nothing here is exercised until the next v* tag is pushed.

Closes FMG-5

The release job authenticated to `git.nakama.town` as `${{ github.actor }}`. Tags are now pushed by the bot account `butterrobot`, so that resolved to `butterrobot` — which holds collaborator rights on the repository but not write access to the container packages under `git.nakama.town/fmartingr/`, since package permissions belong to the owning user rather than the repo. GoReleaser built fine and then died on push with `401 Unauthorized: reqPackageAccess`. That was hard to read off the logs, because the login step reported `Login Succeeded` either way: Forgejo's `/v2/token` hands out an anonymous token when the credential is not authorized, so `docker login` has nothing to fail on. The username is now fixed to `fmartingr`, with a comment recording why it is not derived from the actor. ## Still needs confirming by hand `FORGEJO_TOKEN` must be a token **owned by fmartingr** carrying the `write:package` scope. If it belongs to `butterrobot`, this change alone will not fix the push. I could not verify this: Forgejo never returns a secret's value, owner, or scopes through the API, and the credential available to this run is `butterrobot`, which is not the repo owner (`tea actions secrets list` → `user should be the owner of the repo`). It needs checking in the repository's Actions settings. ## Validation The change is CI configuration only — no Go code is touched. I verified the workflow YAML still parses and that the login step resolves to the intended command; no Go toolchain is available in this environment, so the repo's `format`/`lint`/`test`/`build`/`goreleaser-lint` targets were not run locally. CI covers them on this PR. Nothing here is exercised until the next `v*` tag is pushed. Closes FMG-5

butterrobot added 1 commit

2026-09-08 18:52:58 +02:00

ci: log in to the container registry as fmartingr

CI / goreleaser-lint (pull_request) Successful in 3s

Details

CI / format (pull_request) Successful in 2m28s

Details

CI / lint (pull_request) Successful in 2m43s

Details

CI / test (pull_request) Successful in 2m38s

Details

CI / build (pull_request) Successful in 2m35s

Details

7fbf0ca69f

The release job authenticated to git.nakama.town as `${{ github.actor }}`.
Tags are now pushed by the bot account butterrobot, so that resolved to
butterrobot — which holds collaborator rights on the repository but not
write access to the container packages under git.nakama.town/fmartingr/,
since package permissions belong to the owning user rather than the repo.
The build succeeded and then died on push with
`401 Unauthorized: reqPackageAccess`.

The failure was hard to spot from the logs because the login step reported
"Login Succeeded" either way: Forgejo's /v2/token hands out an anonymous
token when the credential is not authorized, so docker login has nothing
to fail on.

The username is now fixed to fmartingr, and a comment records why it is not
derived from the actor.

FORGEJO_TOKEN must be a token owned by fmartingr carrying the write:package
scope. That cannot be checked from a workflow or the API — Forgejo never
returns a secret's value, owner or scopes — so it needs confirming in the
repository settings.

Closes FMG-5

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>