From 6e4209e745a13e725bb6e8c2e998780b94ece756 Mon Sep 17 00:00:00 2001
From: sirius <sirius@siriusdevops.com>
Date: Fri, 28 Aug 2026 00:15:19 -0400
Subject: [PATCH] ci: login to Forgejo registry with PAT, not GITHUB_TOKEN

Actions GITHUB_TOKEN reports Login Succeeded then 401s on
POST /v2/.../blobs/uploads/. User PAT can write packages.
---
 .forgejo/workflows/build.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index d9bf492..561b71b 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -56,9 +56,14 @@ jobs:
       - name: Login to Forgejo registry
         run: |
           set -euo pipefail
-          # Forgejo Actions token can push packages when packages:write is granted
-          echo "${{ secrets.GITHUB_TOKEN }}" | docker login "${{ steps.img.outputs.reg }}" \
-            -u "${{ github.actor }}" --password-stdin
+          # GITHUB_TOKEN login "succeeds" but blob uploads 401 (Forgejo packages
+          # reject the Actions token). Use a user PAT with write:package.
+          if [ -z "${{ secrets.FORGEJO_TOKEN }}" ]; then
+            echo "Missing repo secret FORGEJO_TOKEN (user PAT, not GITHUB_TOKEN)"
+            exit 1
+          fi
+          echo "${{ secrets.FORGEJO_TOKEN }}" | docker login "${{ steps.img.outputs.reg }}" \
+            -u sirius --password-stdin
 
       - name: Build application image (api / ingester / cameras)
         run: |