rbrooks/Iris-WLED

Watch

Fork 0

CI: authenticate to the registry with REGISTRY_TOKEN, not GITHUB_TOKEN (#64) #85

Merged

claude-bot merged 1 commit from fix/registry-token into main

2026-08-31 05:23:50 +00:00

claude-bot commented

2026-08-31 05:16:24 +00:00

Contributor

Fixes the publish step from b252b8f, which failed on its first real run and left main red.

The failure

unknown: unexpected status from POST request to
https://git.rhoving.com/v2/rbrooks/iris-wled/blobs/uploads/: 401 Unauthorized

docker login succeeded; the push was rejected. secrets.GITHUB_TOKEN does not carry write:package scope on this instance.

I had copied the auth pattern from release.yml — but release.yml has never run (no tags exist, release_counter: 0), so that pattern was never actually exercised. I propagated an unverified assumption rather than checking it.

The working pattern was already on this instance: marginalia publishes here, and its workflow states "Requires a repo Actions secret REGISTRY_TOKEN with write:package scope", then logs in with that token.

Two fixes

1. ci.yml and release.yml both switch to secrets.REGISTRY_TOKEN.

release.yml had the identical latent bug. Because it has never run, it would have failed the same way at the worst possible moment — during an actual release — and taken #3 and #4's "images land in the registry" with it. Better found now than at v1.0.0.

The other GITHUB_TOKEN use further down release.yml is deliberately untouched: creating a release needs repo scope, which that token does have. Only the registry pushes were wrong.

2. Username pinned to rbrooks instead of ${{ github.actor }}.

The token belongs to rbrooks. Now that #56 enabled Renovate automerge, a merged dependency PR runs as renovate-bot, which would not match the token owner — an intermittent failure that would only ever appear on automerged PRs, and would have been thoroughly confusing to diagnose.

Verification

The secret has been created by the operator.

Note that CI passing on this PR does not prove the fix — the publish steps are gated on pushes to main, so they are skipped here. The real test is the main run after merge. I will confirm :main is pullable from the dev host before calling it done, and will not claim success from a green PR alone.

Fixes the publish step from `b252b8f`, which failed on its first real run and left `main` red. ## The failure ``` unknown: unexpected status from POST request to https://git.rhoving.com/v2/rbrooks/iris-wled/blobs/uploads/: 401 Unauthorized ``` `docker login` **succeeded**; the *push* was rejected. `secrets.GITHUB_TOKEN` does not carry `write:package` scope on this instance. I had copied the auth pattern from `release.yml` — but `release.yml` has **never run** (no tags exist, `release_counter: 0`), so that pattern was never actually exercised. I propagated an unverified assumption rather than checking it. The working pattern was already on this instance: `marginalia` publishes here, and its workflow states *"Requires a repo Actions secret REGISTRY_TOKEN with write:package scope"*, then logs in with that token. ## Two fixes **1. `ci.yml` and `release.yml` both switch to `secrets.REGISTRY_TOKEN`.** `release.yml` had the *identical* latent bug. Because it has never run, it would have failed the same way at the worst possible moment — during an actual release — and taken #3 and #4's "images land in the registry" with it. Better found now than at `v1.0.0`. The other `GITHUB_TOKEN` use further down `release.yml` is deliberately untouched: creating a release needs repo scope, which that token *does* have. Only the registry pushes were wrong. **2. Username pinned to `rbrooks` instead of `${{ github.actor }}`.** The token belongs to `rbrooks`. Now that #56 enabled Renovate automerge, a merged dependency PR runs as `renovate-bot`, which would not match the token owner — an intermittent failure that would only ever appear on automerged PRs, and would have been thoroughly confusing to diagnose. ## Verification The secret has been created by the operator. Note that **CI passing on this PR does not prove the fix** — the publish steps are gated on pushes to `main`, so they are skipped here. The real test is the `main` run after merge. I will confirm `:main` is pullable from the dev host before calling it done, and will not claim success from a green PR alone.

claude-bot added 1 commit

2026-08-31 05:16:24 +00:00

CI: authenticate to the registry with REGISTRY_TOKEN, not GITHUB_TOKEN (#64 )

CI / Alembic migration check (pull_request) Successful in 34s

Details

CI / Frontend lint, test & build (pull_request) Successful in 1m11s

Details

CI / Python lint & type-check (pull_request) Successful in 1m21s

Details

CI / Python tests (pull_request) Successful in 1m46s

Details

CI / Docker build, health smoke & E2E (pull_request) Successful in 2m50s

Details

728c6e8be6

The publish step added in b252b8f failed on its first real run. docker login
succeeded, then the push was rejected:

  unknown: unexpected status from POST request to
  https://git.rhoving.com/v2/rbrooks/iris-wled/blobs/uploads/: 401 Unauthorized

secrets.GITHUB_TOKEN does not carry write:package scope on this instance. The
marginalia repo, which already publishes to this registry, uses a dedicated repo
Actions secret REGISTRY_TOKEN holding a Forgejo token with write:package -- its
workflow says so in a comment. Iris now uses the same.

release.yml had the identical latent bug. It has never run (no tags exist,
release_counter is 0), so #3 and #4's "images land in the registry" would have
failed exactly the same way at the worst possible moment -- during a release.
Fixed here too. The GITHUB_TOKEN use further down release.yml is left alone:
creating a release needs repo scope, which that token does have.

The username is pinned to rbrooks rather than ${{ github.actor }}. The token
belongs to rbrooks, and now that #56 enabled Renovate automerge, a merged
dependency PR runs as renovate-bot -- which would not match the token owner.

Requires the REGISTRY_TOKEN secret to exist before main goes green again.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

claude-bot merged commit d8900ac47e into main

2026-08-31 05:23:50 +00:00

claude-bot deleted branch fix/registry-token

2026-08-31 05:23:51 +00:00

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

rbrooks/Iris-WLED!85

No description provided.

Rows
Columns