From 6f840c2d5516af3445c3d9487804ee0a4f2777f0 Mon Sep 17 00:00:00 2001 From: Emma Thorpe Date: Fri, 21 Aug 2026 15:47:05 +0100 Subject: [PATCH] fix: use the registry secret that exists, and allow manual releases The login step referenced PACKAGES_SECRET while the secret configured on this repository -- and on its sibling -- is PACKAGES_TOKEN. The expression resolved to an empty string and docker/login-action failed with "Password required", so the first release published nothing and created no tag. The push trigger only fires on image-affecting paths, which a workflow-only change is not, so merging this fix alone would not produce a release. workflow_dispatch can now cut one, restricted to main so a manual run on another branch cannot tag a commit that is not on the default branch. Verified by running the version step across every event and ref combination: push and workflow_dispatch on main release, everything else does not. Co-Authored-By: Claude Opus 5 (1M context) --- .gitea/workflows/build-and-publish.yaml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/build-and-publish.yaml b/.gitea/workflows/build-and-publish.yaml index b0c0200..ddaf12e 100644 --- a/.gitea/workflows/build-and-publish.yaml +++ b/.gitea/workflows/build-and-publish.yaml @@ -89,8 +89,14 @@ jobs: minor="${rest%%.*}" patch="${rest##*.}" + # workflow_dispatch releases too, so a release can be cut without a + # code change -- the push filter above ignores workflow and doc edits. + # Restricted to main: a manual run elsewhere must not tag a commit + # that is not on the default branch. release="false" - if [ "${GITHUB_EVENT_NAME}" = "push" ] && [ "$bump" != "none" ]; then + if [ "${GITHUB_EVENT_NAME}" != "pull_request" ] \ + && [ "${GITHUB_REF_NAME}" = "main" ] \ + && [ "$bump" != "none" ]; then release="true" case "$bump" in major) major=$((major + 1)); minor=0; patch=0 ;; @@ -127,7 +133,7 @@ jobs: with: registry: ${{ env.REGISTRY }} username: ${{ github.repository_owner }} - password: ${{ secrets.PACKAGES_SECRET }} + password: ${{ secrets.PACKAGES_TOKEN }} - name: Build and push uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7 -- 2.54.0