fix: use the registry secret that exists, and allow manual releases #2

2026-08-21T15:48:03+01:00

lyrathorpe commented

2026-08-21 15:48:03 +01:00

The failure

Run #6 on main failed at the registry login:

password: ${{ secrets.PACKAGES_SECRET }}
username: ${{ github.repository_owner }}
::error::Password required

The reference was present; the value was not. The secret configured on this repository — and on legacy-email-proxy — is named PACKAGES_TOKEN. PACKAGES_SECRET does not exist at repository or user level, so the expression resolved to an empty string and docker/login-action refused.

Nothing was left half-done: the job died before the push, so no image was published and no tag was created.

The second problem

The push trigger fires only on Dockerfile, .dockerignore and music_mirror.py. A workflow-only change — such as this one — matches none of them, so merging the fix by itself would produce no run and no release. workflow_dispatch could not cut one either, because the release condition required push.

workflow_dispatch now releases as well, restricted to main so a manual run on another branch cannot tag a commit that is not on the default branch. That also means the first release can be triggered from the UI rather than by inventing a code change.

Verification

The version step was extracted and run against a scratch repository for every event and ref combination:

Event	Ref	Result
`push`	`main`	release, v0.1.0
`push`	other	no release
`workflow_dispatch`	`main`	release, v0.1.0
`workflow_dispatch`	other	no release
`pull_request`	either	no release

After merging

Merging this will not itself publish anything. Trigger the workflow manually on main to cut v0.1.0.

## The failure Run #6 on `main` failed at the registry login: ``` password: ${{ secrets.PACKAGES_SECRET }} username: ${{ github.repository_owner }} ::error::Password required ``` The reference was present; the value was not. The secret configured on this repository — and on `legacy-email-proxy` — is named **`PACKAGES_TOKEN`**. `PACKAGES_SECRET` does not exist at repository or user level, so the expression resolved to an empty string and `docker/login-action` refused. Nothing was left half-done: the job died before the push, so no image was published and no tag was created. ## The second problem The push trigger fires only on `Dockerfile`, `.dockerignore` and `music_mirror.py`. A workflow-only change — such as this one — matches none of them, so merging the fix by itself would produce no run and no release. `workflow_dispatch` could not cut one either, because the release condition required `push`. `workflow_dispatch` now releases as well, restricted to `main` so a manual run on another branch cannot tag a commit that is not on the default branch. That also means the first release can be triggered from the UI rather than by inventing a code change. ## Verification The version step was extracted and run against a scratch repository for every event and ref combination: | Event | Ref | Result | | ------------------- | ------- | ---------------- | | `push` | `main` | release, v0.1.0 | | `push` | other | no release | | `workflow_dispatch` | `main` | release, v0.1.0 | | `workflow_dispatch` | other | no release | | `pull_request` | either | no release | ## After merging Merging this will not itself publish anything. Trigger the workflow manually on `main` to cut v0.1.0.

lyrathorpe added 1 commit 2026-08-21 15:48:04 +01:00

fix: use the registry secret that exists, and allow manual releases

Build and publish container / build (pull_request) Successful in 4m16s

Details

6f840c2d55

The login step referenced PACKAGES_SECRET while the secret configured on this
repository -- and on its sibling -- is PACKAGES_TOKEN. The expression resolved
to an empty string and docker/login-action failed with "Password required",
so the first release published nothing and created no tag.

The push trigger only fires on image-affecting paths, which a workflow-only
change is not, so merging this fix alone would not produce a release.
workflow_dispatch can now cut one, restricted to main so a manual run on
another branch cannot tag a commit that is not on the default branch.

Verified by running the version step across every event and ref combination:
push and workflow_dispatch on main release, everything else does not.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

lyrathorpe merged commit ebcaa36672 into main

2026-08-21 15:49:02 +01:00

lyrathorpe deleted branch fix/registry-secret-name

2026-08-21 15:49:04 +01:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: lyrathorpe/music-mirror#2