From 9798b522bdf89ba1a1b4a4efa14086e5ef4247d6 Mon Sep 17 00:00:00 2001
From: Octoturge <iwo@octoturge.com>
Date: Thu, 27 Aug 2026 01:40:07 +0200
Subject: [PATCH] ci: use Gitea's built-in GITEA_TOKEN for registry push, drop
 manual PAT

GITEA_PACKAGE_TOKEN was never a creatable secret name (GITEA_ prefix is
reserved), and Gitea Actions' built-in token can be granted registry
write access directly via `permissions: packages: write` (per
https://docs.gitea.com/usage/actions/token-permissions/) - the
"unauthorized: reqPackageAccess" issue noted earlier looks to have been
exactly this: the default restricted token mode denying package write
unless a job explicitly requests it, not an unfixable bug in the token
itself. Drops the manual-PAT requirement entirely - no secret to create
or maintain.
---
 .gitea/workflows/coder-templates.yml | 30 +++++++++++++---------------
 1 file changed, 14 insertions(+), 16 deletions(-)

diff --git a/.gitea/workflows/coder-templates.yml b/.gitea/workflows/coder-templates.yml
index fa55b89..7ee55fa 100644
--- a/.gitea/workflows/coder-templates.yml
+++ b/.gitea/workflows/coder-templates.yml
@@ -10,18 +10,15 @@ name: Provision Coder Templates
 #     orphan running workspaces - it just fails loudly and needs a human.
 #
 # Requires two repo/org secrets (Settings > Actions > Secrets):
-#   CODER_URL              e.g. https://code.octoturge.com
-#   CODER_SESSION_TOKEN    a token from `coder tokens create`, ideally under a
+#   CODER_URL             e.g. https://code.octoturge.com
+#   CODER_SESSION_TOKEN   a token from `coder tokens create`, ideally under a
 #                          dedicated service account rather than a personal one
-#   PACKAGE_REGISTRY_TOKEN a Gitea access token (user Settings > Applications)
-#                          with write:package scope, for pushing each
-#                          Dockerfile-having template's image to this
-#                          instance's container registry. Only the octoturge
-#                          account's own token is used - docker login below
-#                          hardcodes that username to match. Named without a
-#                          GITEA_ prefix because Gitea Actions reserves that
-#                          prefix for its own built-in secrets and rejects
-#                          creating one with that name.
+#
+# Pushing each Dockerfile-having template's image to this instance's
+# container registry uses Gitea's own built-in secrets.GITEA_TOKEN (no
+# manually-created PAT needed) - build-images grants it write access via
+# `permissions: packages: write` below. See
+# https://docs.gitea.com/usage/actions/token-permissions/
 #
 # Any templates/<env>/ that has its own Dockerfile gets its image built and
 # pushed here (build-images, on the dedicated "docker-build" runner - see
@@ -52,6 +49,11 @@ jobs:
     # container.volumes mount for the same path here fails at container
     # creation with "Duplicate mount point: /var/run/docker.sock".
     runs-on: docker-build
+    # The default token permission mode denies package write unless a job
+    # explicitly asks for it - without this, docker push fails with
+    # "unauthorized: reqPackageAccess".
+    permissions:
+      packages: write
     outputs:
       failed_templates: ${{ steps.build.outputs.failed_templates }}
     # docker:27-cli (Alpine) has no bash - only the POSIX /bin/sh (busybox
@@ -77,11 +79,7 @@ jobs:
         id: build
         run: |
           set -e
-          if [ -z "${{ secrets.PACKAGE_REGISTRY_TOKEN }}" ]; then
-            echo "::error::PACKAGE_REGISTRY_TOKEN secret is empty or unset (Settings > Actions > Secrets on this repo) - can't log in to the registry."
-            exit 1
-          fi
-          echo "${{ secrets.PACKAGE_REGISTRY_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin
+          echo "${{ secrets.GITEA_TOKEN }}" | docker login git.octoturge.com -u "${{ github.actor }}" --password-stdin
 
           FAILED=""
           for dockerfile in templates/*/Dockerfile; do