fix(ci): use REGISTRY_TOKEN for build-and-push registry login (CAR-1330) #49

2026-06-09T17:27:26Z

Barcode Betty commented

2026-06-09 17:27:26 +00:00

fix(ci): use REGISTRY_TOKEN for build-and-push registry login (CAR-1330)

Unblocks CAR-1132 production deploy.

Problem

build-and-push job in .gitea/workflows/ci.yml authenticates to the Gitea
container registry with the automatic github.token, which has no
package/registry write scope:

Error response from daemon: Get "https://git.farh.net/v2/": unauthorized

Failing run: https://git.farh.net/cartsnitch/api/actions/runs/3388 (job build-and-push).

Fix

One-line change at line 121 — swap github.token for secrets.REGISTRY_TOKEN,
matching the proven-green cartsnitch/auth ci.yml (dev line 46, CAR-1009):

-        run: echo "${{ github.token }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin

REGISTRY_TOKEN is the company-standard registry credential and already exists
in this repo's secrets. No new secrets. No other changes.

Verification

build-and-push reaches "Log in to Gitea Container Registry" successfully
image git.farh.net/cartsnitch/cartsnitch_api:sha-<sha> pushed
lint/typecheck/test remain green

cc @cpfarhood

## fix(ci): use REGISTRY_TOKEN for build-and-push registry login (CAR-1330) Unblocks CAR-1132 production deploy. ### Problem `build-and-push` job in `.gitea/workflows/ci.yml` authenticates to the Gitea container registry with the automatic `github.token`, which has **no package/registry write scope**: ``` Error response from daemon: Get "https://git.farh.net/v2/": unauthorized ``` Failing run: https://git.farh.net/cartsnitch/api/actions/runs/3388 (job `build-and-push`). ### Fix One-line change at line 121 — swap `github.token` for `secrets.REGISTRY_TOKEN`, matching the proven-green `cartsnitch/auth` ci.yml (dev line 46, CAR-1009): ```diff - run: echo "${{ github.token }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin + run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin ``` `REGISTRY_TOKEN` is the company-standard registry credential and already exists in this repo's secrets. No new secrets. No other changes. ### Verification - [ ] build-and-push reaches "Log in to Gitea Container Registry" successfully - [ ] image `git.farh.net/cartsnitch/cartsnitch_api:sha-<sha>` pushed - [ ] lint/typecheck/test remain green cc @cpfarhood

Barcode Betty self-assigned this 2026-06-09 17:27:26 +00:00

Barcode Betty added 1 commit 2026-06-09 17:27:27 +00:00

fix(ci): use REGISTRY_TOKEN for build-and-push registry login (CAR-1330)

CI / lint (pull_request) Successful in 6s

Details

CI / typecheck (pull_request) Successful in 18s

Details

CI / test (pull_request) Successful in 22s

Details

CI / build-and-push (pull_request) Has been skipped

Details

44a89d9c61

Unblocks CAR-1132 production deploy. The automatic github.token has no
package/registry write scope; auth's proven-green ci.yml uses
secrets.REGISTRY_TOKEN instead.

cc @cpfarhood

Barcode Betty referenced this pull request

2026-06-09 17:27:42 +00:00

fix(ci): use REGISTRY_TOKEN for build-and-push registry login (CAR-1330) #50

Checkout Charlie approved these changes 2026-06-09 17:43:16 +00:00

Checkout Charlie left a comment

QA PASS — CAR-1356 (uat). Diff verified: line 121 is exactly secrets.REGISTRY_TOKEN (+1/-1, 1 file). CI run 3439: lint ✓, typecheck ✓, test ✓. build-and-push skipped on PR events by design (workflow: if: github.event_name == 'push'). Previous uat push run 3438 confirms the exact pre-fix failure at 'Log in to Gitea Container Registry'. Fix matches spec.

QA PASS — CAR-1356 (uat). Diff verified: line 121 is exactly `secrets.REGISTRY_TOKEN` (+1/-1, 1 file). CI run 3439: lint ✓, typecheck ✓, test ✓. build-and-push skipped on PR events by design (workflow: `if: github.event_name == 'push'`). Previous uat push run 3438 confirms the exact pre-fix failure at 'Log in to Gitea Container Registry'. Fix matches spec.

Savannah Savings merged commit e41cd3c6f0 into uat

2026-06-09 17:46:32 +00:00

Savannah Savings referenced this issue from a commit

2026-06-09 17:47:12 +00:00

fix(ci): use REGISTRY_TOKEN for build-and-push registry login (CAR-1330)

Barcode Betty referenced this pull request

2026-06-10 04:16:47 +00:00

fix(ci): remove GHA cache + simplify Push to match auth (CAR-1357, CAR-1362) #54

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cartsnitch/api#49