From 7fbf0ca69f58d9ca219ef604e493280b01cf343d Mon Sep 17 00:00:00 2001 From: butterrobot Date: Tue, 8 Sep 2026 16:52:46 +0000 Subject: [PATCH] ci: log in to the container registry as fmartingr MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The release job authenticated to git.nakama.town as `${{ github.actor }}`. Tags are now pushed by the bot account butterrobot, so that resolved to butterrobot — which holds collaborator rights on the repository but not write access to the container packages under git.nakama.town/fmartingr/, since package permissions belong to the owning user rather than the repo. The build succeeded and then died on push with `401 Unauthorized: reqPackageAccess`. The failure was hard to spot from the logs because the login step reported "Login Succeeded" either way: Forgejo's /v2/token hands out an anonymous token when the credential is not authorized, so docker login has nothing to fail on. The username is now fixed to fmartingr, and a comment records why it is not derived from the actor. FORGEJO_TOKEN must be a token owned by fmartingr carrying the write:package scope. That cannot be checked from a workflow or the API — Forgejo never returns a secret's value, owner or scopes — so it needs confirming in the repository settings. Closes FMG-5 Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1e3ab84..e41b593 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,8 +18,12 @@ jobs: with: go-version-file: go.mod + # Packages under git.nakama.town/fmartingr/ are writable only by the user + # fmartingr, so the username is fixed here: tags may be pushed by a bot + # account, and repo collaborator rights do not grant package write access. + # FORGEJO_TOKEN must therefore be a fmartingr token with write:package. - name: Login to container registry - run: echo "${{ secrets.FORGEJO_TOKEN }}" | docker login git.nakama.town -u ${{ github.actor }} --password-stdin + run: echo "${{ secrets.FORGEJO_TOKEN }}" | docker login git.nakama.town -u fmartingr --password-stdin - name: Run GoReleaser run: goreleaser release --clean -- 2.52.0