From 72331bf3f6d0e299b18f6a21548350c334900789 Mon Sep 17 00:00:00 2001
From: Kilian Boute <kilian.boute@gmail.com>
Date: Thu, 3 Sep 2026 12:41:06 +0000
Subject: [PATCH] fix(release): fall back to package-capable registry token

---
 .github/workflows/release-create.yml | 12 ++++++++----
 README.md                            |  7 +++++++
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release-create.yml b/.github/workflows/release-create.yml
index c18c2d4..eb266bd 100644
--- a/.github/workflows/release-create.yml
+++ b/.github/workflows/release-create.yml
@@ -78,6 +78,10 @@ on:
         type: string
         default: ''
     secrets:
+      REGISTRY_USERNAME:
+        required: false
+      REGISTRY_TOKEN:
+        required: false
       USERNAME:
         required: false
       TOKEN:
@@ -116,8 +120,8 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
+          username: ${{ secrets.REGISTRY_USERNAME || secrets.USERNAME || github.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN || secrets.TOKEN || github.token }}
       - name: Run public dependency build
         if: ${{ !inputs.use_private_module_auth }}
         run: |
@@ -144,8 +148,8 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
+          username: ${{ secrets.REGISTRY_USERNAME || secrets.USERNAME || github.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN || secrets.TOKEN || github.token }}
       - name: Wait for image propagation
         run: sleep 10
       - name: Create and push manifests
diff --git a/README.md b/README.md
index a662c53..b19e39a 100644
--- a/README.md
+++ b/README.md
@@ -145,6 +145,11 @@ caller's `GITHUB_TOKEN`, but it cannot elevate a caller whose permission ceiling
 is read-only. The repository's default workflow permission may remain `read`;
 the explicit caller grant above applies only to this release workflow.
 
+Registry login prefers `REGISTRY_USERNAME` / `REGISTRY_TOKEN`, then the existing
+`USERNAME` / `TOKEN` pair, and finally the caller's `github.actor` /
+`github.token`. Use a registry token when an existing GHCR package does not grant
+the caller repository's `GITHUB_TOKEN` write access.
+
 ## Release bump example
 
 `release-bump.yml` determines the next semantic version from the latest `v*` tag, creates a GitHub release with generated notes, and exposes the new tag as the `tag` output. Because a release created with the default `GITHUB_TOKEN` does not emit a `release: created` event, chain `release-create.yml` directly after it.
@@ -229,6 +234,8 @@ These reusable workflows expect the consuming repository to provide the same sec
 
 - `TOKEN`
 - `USERNAME`
+- `REGISTRY_TOKEN` (optional dedicated package-publishing credential)
+- `REGISTRY_USERNAME` (optional username paired with `REGISTRY_TOKEN`)
 - `CODECOV_TOKEN`
 - `AZURE_OPENAI_API_KEY`