From b38f4760e7358f9266c5326f791338288b0b2841 Mon Sep 17 00:00:00 2001 From: agent Date: Tue, 8 Sep 2026 09:05:43 +0200 Subject: [PATCH] ci: read the org-scoped ZEGIT_CI_PACKAGE_TOKEN, not a repo-local name MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The publish path failed at registry login on every dispatch (runs 18, 20) because it read `secrets.ZEGIT_PACKAGE_TOKEN`, a name that exists nowhere. The package-write token every zegit-zoo image workflow uses is ZEGIT_CI_PACKAGE_TOKEN, held above repository scope, so this repository can read it under that name — no second token, no second copy to rotate. --- .github/workflows/build-image-gitea.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-image-gitea.yml b/.github/workflows/build-image-gitea.yml index d63e87c..c7ff791 100644 --- a/.github/workflows/build-image-gitea.yml +++ b/.github/workflows/build-image-gitea.yml @@ -90,11 +90,11 @@ jobs: - name: Registry login if: ${{ steps.meta.outputs.push == 'true' }} env: - TOKEN: ${{ secrets.ZEGIT_PACKAGE_TOKEN }} + TOKEN: ${{ secrets.ZEGIT_CI_PACKAGE_TOKEN }} run: | set -euo pipefail if [ -z "${TOKEN:-}" ]; then - echo "::error::ZEGIT_PACKAGE_TOKEN is not set, so this dispatch would build an image and push nothing. Issue a package-write token and store it as this secret." + echo "::error::ZEGIT_CI_PACKAGE_TOKEN is not visible to this run. It is the org-scoped package-write token every zegit-zoo image workflow uses (docs: flux-config docs/rotation/forge-secrets.yaml); this repository must be able to read the org secret, and the name must match." exit 1 fi mkdir -p "$HOME/.docker" -- 2.54.0