From 5f7075e2cfdc254d753809af10c4ae914d5119b8 Mon Sep 17 00:00:00 2001 From: Emi Griffith Date: Sat, 1 Aug 2026 11:17:48 -0700 Subject: [PATCH] build-push: drop the empty ${{ }} that silenced the registry login Forgejo evaluates ${{ }} expressions inside a step's `run:` script, comments included. An EMPTY expression is a parse error, and the runner's response is to drop the step -- no log line, no error, no failed status. The login step simply never ran, so every subsequent `docker push` went out anonymous. The registry then answers `unauthorized: reqPackageAccess` (or, depending on the client path, `no basic auth credentials`), which reads exactly like a revoked token or a missing scope. It is neither. Both are downstream of a comment. Isolated on one branch, one variable, back to back: * empty expression present -> both legs fail, no `Login Succeeded` in the log * empty expression removed -> both legs pass, `Login Succeeded` present, sha-df409f88b3fd published for backend and frontend Nothing was wrong with the credential. The token, its scope and whether it sat at repo or organization level were all ruled out first: pushes to jinemi/thermograph/* succeed by hand from vps1 and from the runner host, with matching and mismatched usernames, and the run log shows REGISTRY_TOKEN arriving in the job environment. Do not write a bare ${{ }} in a run block, in a comment or otherwise. --- .forgejo/workflows/build-push.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.forgejo/workflows/build-push.yml b/.forgejo/workflows/build-push.yml index 7a81ba5..034b1bc 100644 --- a/.forgejo/workflows/build-push.yml +++ b/.forgejo/workflows/build-push.yml @@ -131,7 +131,7 @@ jobs: # credential that was in fact valid. Strip first, echo never. # # The token also goes through the ENVIRONMENT rather than being - # interpolated into the script text. `${{ }}` is substituted before bash + # interpolated into the script text. An expression is substituted before bash # parses the line, so a value containing a quote or newline would change # the shape of the command itself rather than just its arguments. tok=$(printf '%s' "$REGISTRY_TOKEN" | tr -d ' \t\r\n')