From f27eb23804b7c1de3eebd6d6ed972b8cef7938e3 Mon Sep 17 00:00:00 2001 From: Octoturge Date: Thu, 27 Aug 2026 01:37:19 +0200 Subject: [PATCH] ci: rename registry secret to PACKAGE_REGISTRY_TOKEN, fail loudly if unset GITEA_PACKAGE_TOKEN was never actually creatable - Gitea Actions reserves the GITEA_ prefix for its own built-in secrets, so Settings > Actions > Secrets rejects a repo secret by that name. The workflow referenced a secret that could never exist, so docker login always got an empty password and failed with a confusing "interactive login from a non TTY device" error. Renamed to PACKAGE_REGISTRY_TOKEN, and added an explicit empty-secret check so a future misconfiguration fails with a clear message instead of that confusing docker error. --- .gitea/workflows/coder-templates.yml | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/.gitea/workflows/coder-templates.yml b/.gitea/workflows/coder-templates.yml index 2c57b3d..fa55b89 100644 --- a/.gitea/workflows/coder-templates.yml +++ b/.gitea/workflows/coder-templates.yml @@ -10,15 +10,18 @@ name: Provision Coder Templates # orphan running workspaces - it just fails loudly and needs a human. # # Requires two repo/org secrets (Settings > Actions > Secrets): -# CODER_URL e.g. https://code.octoturge.com -# CODER_SESSION_TOKEN a token from `coder tokens create`, ideally under a +# CODER_URL e.g. https://code.octoturge.com +# CODER_SESSION_TOKEN a token from `coder tokens create`, ideally under a # dedicated service account rather than a personal one -# GITEA_PACKAGE_TOKEN a Gitea access token (user Settings > Applications) +# PACKAGE_REGISTRY_TOKEN a Gitea access token (user Settings > Applications) # with write:package scope, for pushing each # Dockerfile-having template's image to this # instance's container registry. Only the octoturge # account's own token is used - docker login below -# hardcodes that username to match. +# hardcodes that username to match. Named without a +# GITEA_ prefix because Gitea Actions reserves that +# prefix for its own built-in secrets and rejects +# creating one with that name. # # Any templates// that has its own Dockerfile gets its image built and # pushed here (build-images, on the dedicated "docker-build" runner - see @@ -74,7 +77,11 @@ jobs: id: build run: | set -e - echo "${{ secrets.GITEA_PACKAGE_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin + if [ -z "${{ secrets.PACKAGE_REGISTRY_TOKEN }}" ]; then + echo "::error::PACKAGE_REGISTRY_TOKEN secret is empty or unset (Settings > Actions > Secrets on this repo) - can't log in to the registry." + exit 1 + fi + echo "${{ secrets.PACKAGE_REGISTRY_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin FAILED="" for dockerfile in templates/*/Dockerfile; do