From ffd42eb3d3b98066dad3e7c523836c56c1459c70 Mon Sep 17 00:00:00 2001 From: Felix Faerber Date: Mon, 6 Jul 2026 13:10:54 +0300 Subject: [PATCH] gitea-admin skill: packages section (linking + registry auth facts) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit TOKEN_OPS re-minted with write:package (was 403 on package endpoints despite ops being site admin — token scopes gate admins too). Document package↔repo linking and the registry auth constraints in the skill. Co-Authored-By: Claude Opus 4.8 (1M context) --- .gitea/workflows/scripts/skill-gitea-admin.sh | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.gitea/workflows/scripts/skill-gitea-admin.sh b/.gitea/workflows/scripts/skill-gitea-admin.sh index cdd6f2b..1fff4bf 100644 --- a/.gitea/workflows/scripts/skill-gitea-admin.sh +++ b/.gitea/workflows/scripts/skill-gitea-admin.sh @@ -110,6 +110,19 @@ curl -sS -X POST -H "Authorization: token $SELF_TOKEN" "$API/orgs/{org}/labels" 5. Ensure the repo can run agents — the org must hold the runtime secrets (ANTHROPIC_API_KEY, SELF_TOKEN, TOKEN_* , OLLAMA_URL, OLLAMA_CLOUD_API_KEY); set any missing via the secrets calls above. +## Packages / container registry +Container images pushed by CI land in the **owner's** package namespace (e.g. `ffaerber/-/packages`) +and are NOT automatically shown on the repo's Packages page — link once after the first push: +``` +curl -sS -X POST -H "Authorization: token $SELF_TOKEN" "$API/packages/{owner}/container/{name}/-/link/{repo}" +curl -sS -X POST -H "Authorization: token $SELF_TOKEN" "$API/packages/{owner}/container/{name}/-/unlink" +``` +Registry auth facts (for wiring CI): the internal Actions token (`GITHUB_TOKEN`) is REJECTED by the +container registry — a real PAT is required. A **user**-namespace package is writable only by that +user or a site admin, so CI pushing to `/` needs a PAT minted BY that user with scope +`write:package` only (stored as a repo/user secret, e.g. `REGISTRY_TOKEN`). Your own token carries +`write:package`, so you can link/unlink and (if ever needed) push to any namespace. + ## Admin user management - Create: `POST /admin/users`. Edit: `PATCH /admin/users/{username}`. Delete: `DELETE /admin/users/{username}` (**confirm first**). - List: `GET /admin/users`. -- 2.54.0