fix: Chart build

2026-07-31 10:41:41 +01:00
parent 9f9b384481
commit df1d9658f5
2 changed files with 22 additions and 6 deletions
@@ -126,20 +126,36 @@ jobs:
                  # github.server_url is this Gitea instance, so the registry
                  # host needs no variable of its own and cannot drift from it.
                  REGISTRY: ${{ github.server_url }}/api/packages/${{ github.repository_owner }}/helm/api/charts
+                  # The same pair server-deploy.yml uses for `docker login`.
+                  # RELEASE_TOKEN, not REGISTRY_PASSWORD: the latter is named in
+                  # the docs but set by no workflow, and an unset secret becomes
+                  # an empty password, which Gitea reports as "Failed to
+                  # authenticate user" rather than as a missing credential.
                  REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
-                  REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+                  REGISTRY_TOKEN: ${{ secrets.RELEASE_TOKEN }}
                  CHART_VERSION: ${{ steps.chart.outputs.version }}
              run: |
                  set -eu
                  PKG="dist/vantage-${CHART_VERSION}.tgz"
                  test -f "$PKG"

+                  # Checked explicitly, because the failure it prevents is a
+                  # 401 that looks like a permissions problem on the token that
+                  # was never sent.
+                  if [ -z "${REGISTRY_USER}" ] || [ -z "${REGISTRY_TOKEN}" ]; then
+                      echo "REGISTRY_USER or RELEASE_TOKEN is not set on this repository."
+                      echo "RELEASE_TOKEN needs the write:package scope to publish a chart."
+                      exit 1
+                  fi
+
+                  echo "publishing to ${REGISTRY} as ${REGISTRY_USER}"
+
                  # --fail-with-body so an HTTP error is a failed step with the
                  # server's explanation, rather than a green run that published
                  # nothing. A repeated version is rejected by the registry;
                  # that is the intended behaviour, not something to retry past.
                  curl --fail-with-body -sS \
-                       --user "${REGISTRY_USER}:${REGISTRY_PASSWORD}" \
+                       --user "${REGISTRY_USER}:${REGISTRY_TOKEN}" \
                       -X POST \
                       --upload-file "$PKG" \
                       "$REGISTRY"