viafier/viafier4
1
Fork 0
Code Issues 7 Pull requests Projects Releases Packages 1 Wiki Activity Actions

Replace static registry token with Forgejo job token #11

New issue
Open
opened 2026-06-23 22:04:52 +02:00 by André Keller · 0 comments
André Keller commented 2026-06-23 22:04:52 +02:00
Owner
Copy link

Current state

Forgejo Actions authenticate to the container registry with:

  • REGISTRY_USERNAME
  • REGISTRY_TOKEN

The token has package read/write access and is passed explicitly to the shared container build workflow and private job containers.

The authentication is isolated in shared/workflows, with a compatibility TODO for migration once Forgejo provides the required built-in job-token registry permissions.

Goal

Replace the static registry credentials with the Forgejo job token once the required package pull and push behavior is available in the deployed Forgejo release.

Scope

  • Verify the implemented Forgejo job-token permissions for:

    • pushing container images
    • pulling private container images used as job containers

  • Update the shared container build workflow to authenticate with the built-in job token.

  • Update viafier consumer jobs to pull the private test image without REGISTRY_USERNAME and REGISTRY_TOKEN.

  • Remove the static registry secret and variable when no longer required.

  • Remove the compatibility TODO.

  • Keep registry authentication localized in the shared workflow.

  • Do not introduce an additional authentication abstraction unless required by Forgejo.

Acceptance criteria

  • Test and production images can be pushed with the built-in job token.
  • Lint and test jobs can pull the digest-qualified private test image.
  • REGISTRY_USERNAME and REGISTRY_TOKEN are no longer required by viafier.
  • No long-lived registry credentials are exposed to workflow jobs.
  • Existing devel publication behavior remains unchanged.
Current state Forgejo Actions authenticate to the container registry with: * `REGISTRY_USERNAME` * `REGISTRY_TOKEN` The token has package read/write access and is passed explicitly to the shared container build workflow and private job containers. The authentication is isolated in `shared/workflows`, with a compatibility TODO for migration once Forgejo provides the required built-in job-token registry permissions. Goal Replace the static registry credentials with the Forgejo job token once the required package pull and push behavior is available in the deployed Forgejo release. Scope * Verify the implemented Forgejo job-token permissions for: * pushing container images * pulling private container images used as job containers * Update the shared container build workflow to authenticate with the built-in job token. * Update viafier consumer jobs to pull the private test image without `REGISTRY_USERNAME` and `REGISTRY_TOKEN`. * Remove the static registry secret and variable when no longer required. * Remove the compatibility TODO. * Keep registry authentication localized in the shared workflow. * Do not introduce an additional authentication abstraction unless required by Forgejo. Acceptance criteria * Test and production images can be pushed with the built-in job token. * Lint and test jobs can pull the digest-qualified private test image. * `REGISTRY_USERNAME` and `REGISTRY_TOKEN` are no longer required by viafier. * No long-lived registry credentials are exposed to workflow jobs. * Existing `devel` publication behavior remains unchanged.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
devel
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
viafier/viafier4#11
No description provided.