Octo-Tech/Profiles-for-Coder
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: rename registry secret to PACKAGE_REGISTRY_TOKEN, fail loudly if unset

Browse Source 
GITEA_PACKAGE_TOKEN was never actually creatable - Gitea Actions reserves
the GITEA_ prefix for its own built-in secrets, so Settings > Actions >
Secrets rejects a repo secret by that name. The workflow referenced a
secret that could never exist, so docker login always got an empty
password and failed with a confusing "interactive login from a non TTY
device" error. Renamed to PACKAGE_REGISTRY_TOKEN, and added an explicit
empty-secret check so a future misconfiguration fails with a clear
message instead of that confusing docker error.
This commit is contained in:
Iwo Strzeboński
2026-08-27 01:37:19 +02:00
parent ea4ab76724
commit f27eb23804
1 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/coder-templates.yml
+12 -5
View File
@@ -10,15 +10,18 @@ name: Provision Coder Templates
# orphan running workspaces - it just fails loudly and needs a human. # orphan running workspaces - it just fails loudly and needs a human.
# #
# Requires two repo/org secrets (Settings > Actions > Secrets): # Requires two repo/org secrets (Settings > Actions > Secrets):
# CODER_URL e.g. https://code.octoturge.com # CODER_URL e.g. https://code.octoturge.com
# CODER_SESSION_TOKEN a token from `coder tokens create`, ideally under a # CODER_SESSION_TOKEN a token from `coder tokens create`, ideally under a
# dedicated service account rather than a personal one # dedicated service account rather than a personal one
# GITEA_PACKAGE_TOKEN a Gitea access token (user Settings > Applications) # PACKAGE_REGISTRY_TOKEN a Gitea access token (user Settings > Applications)
# with write:package scope, for pushing each # with write:package scope, for pushing each
# Dockerfile-having template's image to this # Dockerfile-having template's image to this
# instance's container registry. Only the octoturge # instance's container registry. Only the octoturge
# account's own token is used - docker login below # account's own token is used - docker login below
# hardcodes that username to match. # hardcodes that username to match. Named without a
# GITEA_ prefix because Gitea Actions reserves that
# prefix for its own built-in secrets and rejects
# creating one with that name.
# #
# Any templates/<env>/ that has its own Dockerfile gets its image built and # Any templates/<env>/ that has its own Dockerfile gets its image built and
# pushed here (build-images, on the dedicated "docker-build" runner - see # pushed here (build-images, on the dedicated "docker-build" runner - see
@@ -74,7 +77,11 @@ jobs:
id: build id: build
run: | run: |
set -e set -e
echo "${{ secrets.GITEA_PACKAGE_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin if [ -z "${{ secrets.PACKAGE_REGISTRY_TOKEN }}" ]; then
echo "::error::PACKAGE_REGISTRY_TOKEN secret is empty or unset (Settings > Actions > Secrets on this repo) - can't log in to the registry."
exit 1
fi
echo "${{ secrets.PACKAGE_REGISTRY_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin
FAILED="" FAILED=""
for dockerfile in templates/*/Dockerfile; do for dockerfile in templates/*/Dockerfile; do