From d6fc2477f30b415ba68031815acb8e409740172d Mon Sep 17 00:00:00 2001 From: Felix Faerber Date: Tue, 15 Sep 2026 12:36:51 +0300 Subject: [PATCH] declare packages: write so the registry login works The first build pushed nothing: `docker login git.ffaerber.duckdns.org` came back "unauthorized". Gitea scopes the automatic Actions token from the job's permissions block, and without one it has no package write -- so the build succeeded and the push failed on auth, which reads like a credential problem rather than a missing declaration. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01CYFnHida4AdiNDek2pzgXx --- .gitea/workflows/docker.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml index 07470fd..605e8c1 100644 --- a/.gitea/workflows/docker.yml +++ b/.gitea/workflows/docker.yml @@ -11,6 +11,13 @@ on: pull_request: workflow_dispatch: +# Gitea derives the automatic token's scopes from this block; without it the +# token cannot write packages and `docker login` to this instance's registry +# fails with a bare "unauthorized". +permissions: + contents: read + packages: write + jobs: build: # The homelab runner (a container on pluto, sharing the host docker daemon).