From afa8da647f66a2f37f29d746c51eb9897b85156c Mon Sep 17 00:00:00 2001
From: mfwadejr <125498560+mfwadejr@users.noreply.github.com>
Date: Mon, 21 Sep 2026 22:35:37 +0000
Subject: [PATCH] Use a package-scoped token for Gitea's container registry
 login

Gitea's own auto-injected GITHUB_TOKEN isn't authorized to write
packages on this instance even with packages:write declared, so the
Gitea-side publish kept failing at login despite targeting the right
registry. Added a REGISTRY_TOKEN repo secret (Gitea PAT scoped to
package: read/write only) and use it when the runner is Gitea; GitHub
keeps using its own real GITHUB_TOKEN for ghcr.io.
---
 .github/workflows/publish-container.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish-container.yml b/.github/workflows/publish-container.yml
index a95ac92..a1a0856 100644
--- a/.github/workflows/publish-container.yml
+++ b/.github/workflows/publish-container.yml
@@ -34,7 +34,7 @@ jobs:
         with:
           registry: ${{ steps.registry.outputs.registry }}
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ github.server_url == 'https://github.com' && secrets.GITHUB_TOKEN || secrets.REGISTRY_TOKEN }}
 
       - name: Generate image tags
         id: meta