From f2f3e4e3f9fd7137ff775eefdc163f194271e624 Mon Sep 17 00:00:00 2001 From: Felix Faerber Date: Tue, 15 Sep 2026 12:36:51 +0300 Subject: [PATCH] declare packages: write so the registry login works The first build pushed nothing: `docker login git.ffaerber.duckdns.org` came back "unauthorized". Gitea scopes the automatic Actions token from the job's permissions block, and without one it has no package write -- so the build succeeded and the push failed on auth, which reads like a credential problem rather than a missing declaration. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01CYFnHida4AdiNDek2pzgXx --- .gitea/workflows/docker.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml index 753b9b0..c4b6a88 100644 --- a/.gitea/workflows/docker.yml +++ b/.gitea/workflows/docker.yml @@ -21,6 +21,13 @@ on: env: HOMELAB_API_URL: https://t4tgw-api.ffaerber.duckdns.org +# Gitea derives the automatic token's scopes from this block; without it the +# token cannot write packages and `docker login` to this instance's registry +# fails with a bare "unauthorized". +permissions: + contents: read + packages: write + jobs: build: runs-on: ci-runner