Skip to content

Fall back to package-capable registry credentials - #8

Closed
KilianBoute wants to merge 1 commit into
mainfrom
fix/registry-token-fallback
Closed

KilianBoute wants to merge 1 commit into
mainfrom
fix/registry-token-fallback

Conversation

@KilianBoute

Copy link
Copy Markdown
Member

Fix reusable release image pushes when the caller repository's GITHUB_TOKEN has packages: write scope but lacks Actions access to an existing granular GHCR package.

The release workflow now authenticates to the registry with this precedence for both architecture and manifest pushes:

  1. REGISTRY_USERNAME / REGISTRY_TOKEN
  2. legacy inherited USERNAME / TOKEN
  3. github.actor / github.token

This preserves repository-scoped tokens where they work while allowing existing package-capable credentials to publish packages such as hub-pipeline-export-platform.

Validation:

  • git diff --check origin/main...fix/registry-token-fallback
  • GOWORK=off go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/*.yml

After merge, rerun the failed hub-pipeline-export v1.2.15 release workflow; the caller uses uug-ai/workflows@main and secrets: inherit, so no new export tag is required.

@KilianBoute
KilianBoute deleted the fix/registry-token-fallback branch September 11, 2026 14:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant