Can't push packages with default token
We push packages for testing via CI in Eclipse KUKSA project.
In our main repository, it is possible to use the default GH token for this (of course only when building code originating inside that repo, not forks. But that is ok), i.e. this works
- name: Log in to the Container registry
if: needs.checkrights.outputs.have_secrets == 'true'
uses: docker/login-action@v2
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Build kuksa.val databroker container container and push to ghcr.io (and ttl.sh)
id: ghcr-build
if: ${{ needs.checkrights.outputs.have_secrets == 'true' && github.event_name != 'pull_request' }}
uses: docker/build-push-action@v3
...
from https://github.com/eclipse/kuksa.val/blob/master/.github/workflows/kuksa_databroker_build.yml
In another of our project repositories, this does not work, see
https://github.com/eclipse/kuksa.val.feeders/blob/main/.github/workflows/kuksa_gps_feeder.yml
- name: Log in to the Container registry
if: needs.checkrights.outputs.have_secrets == 'true'
uses: docker/login-action@v2
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Build and push KUKSA gps feeder container image and push to ghcr.io
if: ${{ needs.checkrights.outputs.have_secrets == 'true' && github.event_name != 'pull_request' }}
uses: docker/build-push-action@v3
will fail, see
https://github.com/eclipse/kuksa.val.feeders/actions/runs/4147832765/jobs/7175170617
buildx failed with: error: failed to solve: unexpected status: 403 Forbidden
One reason might be, that in the past we pushed in that repository using a "special secret", see e.g here https://github.com/eclipse/kuksa.val.feeders/blob/v0.1.1/.github/workflows/kuksa_gps_feeder.yml
it was doing
- name: Log in to the Container registry
if: needs.check_push_rights.outputs.have_secrets == 'true'
uses: docker/login-action@v2
with:
registry: ${{ needs.check_push_rights.outputs.registry }}
username: kuksa-bot
password: ${{ secrets.PUSH_CONTAINER_TOKEN }}
In order to unify or CI a little bit, we would like to use the standard secrets.GITHUB_TOKEN here as well. as I have not many rights in the repo, I am not sure this is an issue with the repository settings, or with the package settings. (the package in question here is https://github.com/eclipse/kuksa.val.feeders/pkgs/container/kuksa.val.feeders%2Fgps)
can you check and rectify it, so that in val.feeders pushing to GHCR works just with the default token as well?
Thank you