From 81f4e6f2b9aa322a9d0073c8c3599928518fe6e0 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 8 Nov 2026 08:27:49 +0900 Subject: [PATCH] Push release images with a packages-write token The ghcr.io/keiailab/postgres-operator package denies write to the repo's GITHUB_TOKEN ("denied: permission_denied: write_package"). Granting Actions access on an org package is UI-only, so the image job of v0.4.0-beta.10/11/12 failed identically at docker push. Login (image, sign-image) and the SLSA generator now use repo variable GHCR_PUSH_USER and secret GHCR_PUSH_TOKEN, falling back to github.actor / GITHUB_TOKEN when unset. The username is a variable because `secrets` is not a valid context in a reusable workflow's `with:` block. Action pins unchanged. --- .github/workflows/release.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 43d4886..bb6cd1d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -69,8 +69,8 @@ jobs: - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 with: registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + username: ${{ vars.GHCR_PUSH_USER || github.actor }} + password: ${{ secrets.GHCR_PUSH_TOKEN || secrets.GITHUB_TOKEN }} - id: meta uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 with: @@ -104,8 +104,8 @@ jobs: - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 with: registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + username: ${{ vars.GHCR_PUSH_USER || github.actor }} + password: ${{ secrets.GHCR_PUSH_TOKEN || secrets.GITHUB_TOKEN }} - name: cosign sign image (digest-pinned) env: COSIGN_EXPERIMENTAL: "1" @@ -128,9 +128,9 @@ jobs: with: image: ghcr.io/keiailab/postgres-operator digest: ${{ needs.image.outputs.digest }} - registry-username: ${{ github.actor }} + registry-username: ${{ vars.GHCR_PUSH_USER || github.actor }} secrets: - registry-password: ${{ secrets.GITHUB_TOKEN }} + registry-password: ${{ secrets.GHCR_PUSH_TOKEN || secrets.GITHUB_TOKEN }} sbom: name: SBOM (syft) + signature