From fa6eb856dc75db27d6093ee368ce6094c337fc9a Mon Sep 17 00:00:00 2001
From: HRiggs <hriggs0@protonmail.com>
Date: Fri, 2 Oct 2026 13:02:06 -0400
Subject: [PATCH] actions: registry token

---
 .gitea/workflows/container.yml | 15 +++++++++++++--
 README.md                      | 12 +++++++++---
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/container.yml b/.gitea/workflows/container.yml
index 06f69c5..95e990c 100644
--- a/.gitea/workflows/container.yml
+++ b/.gitea/workflows/container.yml
@@ -40,12 +40,23 @@ jobs:
           echo "registry=$registry" >> "$GITHUB_OUTPUT"
           echo "image=$registry/$repository" >> "$GITHUB_OUTPUT"
 
+      - name: Verify registry credentials
+        shell: bash
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [[ -z "$REGISTRY_TOKEN" ]]; then
+            echo "::error::Add a REGISTRY_TOKEN repository secret containing a Gitea personal access token with write:package permission."
+            exit 1
+          fi
+
       - name: Log in to Gitea Container Registry
         uses: docker/login-action@v3
         with:
           registry: ${{ steps.image.outputs.registry }}
-          username: ${{ secrets.REGISTRY_USERNAME || github.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
+          username: ${{ secrets.REGISTRY_USERNAME || 'HRiggs' }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Generate image metadata
         id: meta
diff --git a/README.md b/README.md
index c5c5970..7aaec6c 100644
--- a/README.md
+++ b/README.md
@@ -72,9 +72,15 @@ git.hudsonriggs.systems/hriggs/progressionmods:latest
 ```
 
 Published tags include `latest`, the branch or semantic version, and
-`sha-<commit>`. The workflow uses the Gitea action token by default. If the
-server does not grant that token package-write access, configure repository
-secrets named `REGISTRY_USERNAME` and `REGISTRY_TOKEN`.
+`sha-<commit>`. Before running the workflow, configure `REGISTRY_TOKEN` as a
+repository Actions secret containing a Gitea personal access token with
+`write:package` permission.
+
+The registry username defaults to `HRiggs`. An optional `REGISTRY_USERNAME`
+secret can override it.
+
+Gitea's built-in Actions token cannot currently publish OCI packages, so the
+registry token is required even though the workflow requests `packages: write`.
 
 ### Mod-list endpoints