fix: authenticate metaproxy image publishing - #4
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📑 变更描述 / Description\n\nGHCR package metaproxy-newapi is a private user-scoped package with no linked repository. Its existing layers therefore reject the repository-scoped GITHUB_TOKEN with permission_denied: read_package, even though the workflow declares packages: write.\n\nUse the repository's GHCR_TOKEN secret for registry login. The secret contains a publisher credential with write:packages; no credential value is committed or printed.\n\n## 🚀 变更类型 / Type of change\n\n- [ ] 🐞 Bug 修复 (Bug fix)\n- [ ] ✨ 新功能 (New feature)\n- [x] ⚡ 性能优化 / 重构 (Refactor)\n- [ ] 📑 文档更新 (Documentation)\n\n## 🔗 关联任务 / Related Issue\n\n- No issue. This follows two failed release runs: 33104406497 and 33104667553.\n\n## ✅ 提交前检查项 / Checklist\n\n- [ ] 人工确认: 此说明由 Codex 协助整理，并非声称纯人工撰写。\n- [x] 非重复提交: 已检查当前 fork 的开放 PR。\n- [x] Bug fix 说明: 本 PR 未标记为 Bug fix。\n- [x] 变更理解: 已确认失败发生在 GHCR 读取既有私有层的授权阶段。\n- [x] 范围聚焦: 仅修改 metaproxy 镜像发布登录凭据来源。\n- [x] 本地验证: 已用同一凭据从本机成功推送完全相同的 tag。\n- [x] 安全合规: token 只存储于 GitHub Actions secret，未写入仓库或日志。\n\n## 📳 运行证明 / Proof of Work\n\n- Tag-triggered run 33104406497: image built; push failed with permission_denied: read_package.\n- Manual run 33104667553: reproduced the same permission failure.\n- Local authenticated push succeeded for �1.0.0-rc.21-metaproxy.3, digest sha256:20eee3665d679c45d11a9658b01dc36ef2a45c7d03dccf1c365956b8004d35e1.\n- GHCR_TOKEN is present in repository Actions secrets.