ci: log in to the container registry as fmartingr (FMG-5) #10
2026-09-08
ci: log in to the container registry as fmartingr
All checks were successful
The release job authenticated to git.nakama.town as `${{ github.actor }}`.
Tags are now pushed by the bot account butterrobot, so that resolved to
butterrobot — which holds collaborator rights on the repository but not
write access to the container packages under git.nakama.town/fmartingr/,
since package permissions belong to the owning user rather than the repo.
The build succeeded and then died on push with
`401 Unauthorized: reqPackageAccess`.
The failure was hard to spot from the logs because the login step reported
"Login Succeeded" either way: Forgejo's /v2/token hands out an anonymous
token when the credential is not authorized, so docker login has nothing
to fail on.
The username is now fixed to fmartingr, and a comment records why it is not
derived from the actor.
FORGEJO_TOKEN must be a token owned by fmartingr carrying the write:package
scope. That cannot be checked from a workflow or the API — Forgejo never
returns a secret's value, owner or scopes — so it needs confirming in the
repository settings.
Closes FMG-5
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>