feat: optional ghcr-token for user-owned packages - #52
Merged
Conversation
The first real release failed with "ghcr.io/cshuttle/topology:latest does not exist" — for an image whose digest reads fine from a workstation. The registry returns the same not-found for an unauthorised read, and cshuttle is a personal account: a package bootstrapped by a manual push is USER-owned, so the repo-scoped GITHUB_TOKEN 403s on it. Topology's own build workflow has used a classic PAT for exactly this reason since July; the release path had no way to. Adds an optional ghcr-token secret, used for the crane login when supplied. Also rewrites the error, which confidently blamed absence for what is almost always auth and would have sent the next person hunting for a missing tag. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second finding from the first real release — this one only reachable by running it.
What happened
It exists. Its digest reads fine from a workstation. The registry returns the same
not foundfor an unauthorised read, andcshuttleis a personal account: a package bootstrapped by a manual push is user-owned, so the repo-scopedGITHUB_TOKEN403s on it. Topology's ownbuild.ymlhas pushed with a classic PAT since July for precisely this reason, documented in its header — the release path simply had no way to do the same.Changes
ghcr-tokensecret, used for the crane login when supplied,GITHUB_TOKENotherwise. Repos that push with a PAT pass the same PAT.Why minor, not patch
Callers gain an input some of them need to set. Nothing breaks for a caller that omits it.