From e56662194ba497bcabfbc560896196a9db4a9c2f Mon Sep 17 00:00:00 2001 From: mr-forust Date: Tue, 29 Sep 2026 14:21:57 +0200 Subject: [PATCH] fix(ci): log in to registry for manifest-only main pushes The pin step writes manifest PUTs on every main push, but login was gated on services != ''. Manifest-only pushes skipped login and pushed anonymously (401); this only worked before via a stale persistent login on the old runner. --- .gitea/workflows/ci.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 616a88f..4f38e41 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -390,7 +390,11 @@ jobs: echo "services=$(paste -sd, /tmp/services.txt)" >> "$GITHUB_OUTPUT" - name: Log in to registry - if: steps.services.outputs.services != '' + # The pin step below also writes (manifest PUTs), and it runs on every + # main push — including manifest-only ones where services is empty. A + # stale persistent login on the old runner used to mask this; a clean + # runner pushes anonymously and gets 401. + if: steps.services.outputs.services != '' || github.ref_name == 'main' shell: bash # Through env, not by substitution into the script. A secret written # into a run: block is pasted into the shell source before bash parses