From 268fb97a1c0203e8b64bdcd008c308019308e21e Mon Sep 17 00:00:00 2001 From: Octoturge Date: Thu, 27 Aug 2026 01:54:07 +0200 Subject: [PATCH] docs: note that GITEA_TOKEN impersonates the pushing account, not the owner Documents what we just found the hard way: build-images's docker push runs as whichever Gitea account authenticated the triggering push (github.actor), which needs its own package-registry write access - separate from that account having git push rights to the repo at all. --- .gitea/workflows/coder-templates.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.gitea/workflows/coder-templates.yml b/.gitea/workflows/coder-templates.yml index 7ee55fa..29c0a9d 100644 --- a/.gitea/workflows/coder-templates.yml +++ b/.gitea/workflows/coder-templates.yml @@ -20,6 +20,13 @@ name: Provision Coder Templates # `permissions: packages: write` below. See # https://docs.gitea.com/usage/actions/token-permissions/ # +# GITEA_TOKEN impersonates whoever authenticated the triggering push +# (github.actor), not necessarily the repo owner - that account needs +# write access to this repo's package registry itself, separate from +# having git push access to the repo. A push authenticated as an account +# without registry access fails at docker login with a plain +# "unauthorized" (not a token/config problem). +# # Any templates// that has its own Dockerfile gets its image built and # pushed here (build-images, on the dedicated "docker-build" runner - see # templates/web/main.tf for why: that runner is scoped to this repo only and