actions: registry token

.gitea/workflows/container.yml

@@ -40,12 +40,23 @@ jobs:
           echo "registry=$registry" >> "$GITHUB_OUTPUT"
           echo "image=$registry/$repository" >> "$GITHUB_OUTPUT"
 
+      - name: Verify registry credentials
+        shell: bash
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [[ -z "$REGISTRY_TOKEN" ]]; then
+            echo "::error::Add a REGISTRY_TOKEN repository secret containing a Gitea personal access token with write:package permission."
+            exit 1
+          fi
+
       - name: Log in to Gitea Container Registry
         uses: docker/login-action@v3
         with:
           registry: ${{ steps.image.outputs.registry }}
-          username: ${{ secrets.REGISTRY_USERNAME || github.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
+          username: ${{ secrets.REGISTRY_USERNAME || 'HRiggs' }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Generate image metadata
         id: meta

README.md

@@ -72,9 +72,15 @@ git.hudsonriggs.systems/hriggs/progressionmods:latest
 ```
 
 Published tags include `latest`, the branch or semantic version, and
-`sha-<commit>`. The workflow uses the Gitea action token by default. If the
-server does not grant that token package-write access, configure repository
-secrets named `REGISTRY_USERNAME` and `REGISTRY_TOKEN`.
+`sha-<commit>`. Before running the workflow, configure `REGISTRY_TOKEN` as a
+repository Actions secret containing a Gitea personal access token with
+`write:package` permission.
+
+The registry username defaults to `HRiggs`. An optional `REGISTRY_USERNAME`
+secret can override it.
+
+Gitea's built-in Actions token cannot currently publish OCI packages, so the
+registry token is required even though the workflow requests `packages: write`.
 
 ### Mod-list endpoints