From d101f27d591b4960531a90c14b81469018147880 Mon Sep 17 00:00:00 2001 From: Rex Raphael Date: Fri, 7 Aug 2026 11:56:29 -0500 Subject: [PATCH] fix(go-binary-release): grant packages: write so GHCR pushes can succeed The job declared `permissions: contents: write` and nothing else. Once any permissions block exists everything unlisted is `none`, so GITHUB_TOKEN had `packages: none` -- while the `docker: true` path logs into the registry as exactly that token and then pushes. Callers could not work around it. A reusable workflow's own block is the authoritative one for its jobs, so a caller declaring `packages: write` on the calling job changed nothing, and GORELEASER_TOKEN never reaches the login step, which hardcodes secrets.GITHUB_TOKEN. The result was a release that built for six minutes and then failed with denied: installation not allowed to Write organization package which reads like a registry ACL problem and is not one -- the token has no packages scope to exercise, so granting the repository write access on the package does not change the outcome. Harmless when `docker` is false: nothing authenticates to a registry on that path, so the scope goes unused. Found releasing xraph/forge, which is pinned to @v1 and needs that tag moved to pick this up. --- .github/workflows/go-binary-release.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/.github/workflows/go-binary-release.yml b/.github/workflows/go-binary-release.yml index 5f38975..b053351 100644 --- a/.github/workflows/go-binary-release.yml +++ b/.github/workflows/go-binary-release.yml @@ -50,6 +50,24 @@ jobs: runs-on: ubuntu-latest permissions: contents: write + # Required whenever `docker: true`: the login below authenticates to the + # registry as GITHUB_TOKEN, and pushing to ghcr.io needs package write. + # + # This block is the authoritative one for this job -- a caller's + # `permissions:` cannot widen what a reusable workflow declares -- and once + # any block exists, everything unlisted is `none`. So callers that did + # declare `packages: write` themselves still got `packages: none` here, and + # the push failed after a full build with + # + # denied: installation not allowed to Write organization package + # + # which reads like a registry ACL problem and is not one: the token has no + # packages scope to exercise. Granting the repository write access on the + # package does not change it. + # + # Harmless when `docker` is false -- nothing authenticates to a registry + # on that path, so the scope goes unused. + packages: write steps: - name: Checkout uses: actions/checkout@v7