octoturge
268fb97a1c
Documents what we just found the hard way: build-images's docker push runs as whichever Gitea account authenticated the triggering push (github.actor), which needs its own package-registry write access - separate from that account having git push rights to the repo at all.