From 05d5249e2049858f540022536f2eab28f564226f Mon Sep 17 00:00:00 2001 From: Bryan Van Deusen Date: Sun, 19 Jul 2026 13:32:37 -0400 Subject: [PATCH] M0 CI: derive registry username from github.repository_owner The registry login needed a REGISTRY_USER secret that couldn't be set/read on this fresh repo (harness blocks secret writes; the value never surfaced via the API). The username is the repo owner and is public (it's in the image path), so derive it from github.repository_owner instead of a secret. REGISTRY_TOKEN remains the actual credential. Removes an entire class of setup friction. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm --- .forgejo/workflows/ci.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml index 964c02b..e091f8c 100644 --- a/.forgejo/workflows/ci.yml +++ b/.forgejo/workflows/ci.yml @@ -8,9 +8,10 @@ # tip (family rule 46) — no version release required. The : image is the # immutable rollback unit for every build. # -# Required secrets (repo -> Settings -> Secrets -> Actions): -# REGISTRY_USER -- Forgejo username +# Required secret (repo -> Settings -> Secrets -> Actions): # REGISTRY_TOKEN -- Forgejo PAT with write:packages scope +# The registry username is derived from github.repository_owner (public — it's in +# the image path), so no REGISTRY_USER secret is needed. name: CI & Build on: @@ -142,7 +143,7 @@ jobs: uses: docker/login-action@v4 with: registry: ${{ env.REGISTRY }} - username: ${{ secrets.REGISTRY_USER }} + username: ${{ github.repository_owner }} password: ${{ secrets.REGISTRY_TOKEN }} - name: Build and push