Repository navigation
Push release images with a packages-write token - #307
Conversation
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e19d4a1c5a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| image: ghcr.io/keiailab/postgres-operator | ||
| digest: ${{ needs.image.outputs.digest }} | ||
| registry-username: ${{ github.actor }} | ||
| registry-username: ${{ secrets.GHCR_PUSH_USER || github.actor }} |
There was a problem hiding this comment.
For every release run, this reusable-workflow with input references secrets, but GitHub’s context-availability table does not allow that context for jobs.<job_id>.with.<with_id>. Actions rejects the workflow before its jobs start; use an allowed context such as vars for the username, while keeping the token under jobs.provenance.secrets.
Useful? React with 👍 / 👎.
The ghcr.io/keiailab/postgres-operator package denies write to the
repo's GITHUB_TOKEN ("denied: permission_denied: write_package").
Granting Actions access on an org package is UI-only, so the image
job of v0.4.0-beta.10/11/12 failed identically at docker push.
Login (image, sign-image) and the SLSA generator now use repo
variable GHCR_PUSH_USER and secret GHCR_PUSH_TOKEN, falling back to
github.actor / GITHUB_TOKEN when unset. The username is a variable
because `secrets` is not a valid context in a reusable workflow's
`with:` block. Action pins unchanged.
e19d4a1 to
81f4e6f
Compare
The ghcr.io/keiailab/postgres-operator package denies write to the
repo's GITHUB_TOKEN ("denied: permission_denied: write_package").
Granting Actions access on an org package is UI-only, so the image
job of v0.4.0-beta.10/11/12 failed identically at docker push.
Login (image, sign-image) and the SLSA generator now use
GHCR_PUSH_USER / GHCR_PUSH_TOKEN repo secrets, falling back to
github.actor / GITHUB_TOKEN when unset. Action pins unchanged.
Release run 42424886751 (tag v0.4.0-beta.12) failed at
docker pushwithdenied: permission_denied: write_package. After merge the release is re-run viaworkflow_dispatch -f tag=v0.4.0-beta.12on main; all checkouts already resolveinputs.tag || github.ref, so the tag's tree (4273b4f) is built.