From 70786f73abdd8d304ddf614d7a8371735481300c Mon Sep 17 00:00:00 2001
From: Felix Faerber <ffaerber@gmail.com>
Date: Tue, 15 Sep 2026 12:38:14 +0300
Subject: [PATCH] push with a write:package token, not the Actions token

Second build failed the same way: docker login to this instance's registry
returns "unauthorized" for the automatic Actions token, and declaring
permissions: packages: write did not change it -- Gitea's task token is accepted
by the API but not by the package registry.

So the push uses REGISTRY_TOKEN, an org secret holding a personal access token
scoped to write:package and nothing else. The step fails with that sentence in
the log rather than another bare "unauthorized", because the difference
between a missing secret and a rejected credential is not visible from the
error docker prints.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYFnHida4AdiNDek2pzgXx
---
 .gitea/workflows/docker.yml | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
index c4b6a88..829efbf 100644
--- a/.gitea/workflows/docker.yml
+++ b/.gitea/workflows/docker.yml
@@ -21,13 +21,6 @@ on:
 env:
   HOMELAB_API_URL: https://t4tgw-api.ffaerber.duckdns.org
 
-# Gitea derives the automatic token's scopes from this block; without it the
-# token cannot write packages and `docker login` to this instance's registry
-# fails with a bare "unauthorized".
-permissions:
-  contents: read
-  packages: write
-
 jobs:
   build:
     runs-on: ci-runner
@@ -50,7 +43,17 @@ jobs:
         if: github.event_name != 'pull_request'
         run: |
           set -eu
-          echo "${{ secrets.GITEA_TOKEN }}" | docker login git.ffaerber.duckdns.org -u "${{ github.actor }}" --password-stdin
+          # Not the automatic Actions token: this Gitea's package registry rejects
+          # it (docker login returns a bare "unauthorized"), with or without a
+          # permissions: packages: write block. REGISTRY_TOKEN is an org secret
+          # holding a personal access token scoped to write:package only.
+          if [ -z "${{ secrets.REGISTRY_TOKEN }}" ]; then
+            echo "REGISTRY_TOKEN is not set — create a token with the write:package scope" >&2
+            echo "and add it as an org secret on token-for-token. The image built fine;" >&2
+            echo "only the push needs it." >&2
+            exit 1
+          fi
+          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.ffaerber.duckdns.org -u "${{ vars.REGISTRY_USER || 'ffaerber' }}" --password-stdin
           docker tag "$IMAGE:$SHA" "$IMAGE:latest"
           docker push "$IMAGE:$SHA"
           docker push "$IMAGE:latest"