Skip to content

Fall back to package-capable registry credentials - #7

Closed
KilianBoute wants to merge 1 commit into
mainfrom
fix/registry-token-fallback
Closed

KilianBoute wants to merge 1 commit into
mainfrom
fix/registry-token-fallback

Conversation

@KilianBoute

Copy link
Copy Markdown
Member

Summary

  • allow callers to provide dedicated REGISTRY_USERNAME / REGISTRY_TOKEN credentials
  • fall back to the existing inherited USERNAME / TOKEN pair for backward compatibility
  • use the caller repository token only when no explicit package credential is available
  • apply the same credential chain to architecture image and manifest pushes

Why

After the scoped credential change, Vault's release build logged into GHCR with github.token. The token had packages: write declared but lacked write access to the existing uug-ai/vault-platform package, so the build completed and then failed with permission_denied: write_package.

Validation

  • VS Code GitHub Actions diagnostics: no errors
  • npx --yes yaml-lint .github/workflows/release-create.yml
  • git diff --check
  • repository forbidden-secret policy checks

@KilianBoute KilianBoute closed this Sep 3, 2026
@KilianBoute
KilianBoute deleted the fix/registry-token-fallback branch September 3, 2026 12:50
@KilianBoute
KilianBoute restored the fix/registry-token-fallback branch September 10, 2026 10:56
@KilianBoute
KilianBoute deleted the fix/registry-token-fallback branch September 11, 2026 14:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant