From 5f59a3d0043c24f1c0b849abb83669a090f1059e Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Thu, 14 May 2026 19:07:06 +0200
Subject: [PATCH] fix CI not being allowed to push container image

---
 .forgejo/workflows/container.yml | 29 ++++++++++++++++++++---------
 1 file changed, 20 insertions(+), 9 deletions(-)

diff --git a/.forgejo/workflows/container.yml b/.forgejo/workflows/container.yml
index 554b2e9..5bcb123 100644
--- a/.forgejo/workflows/container.yml
+++ b/.forgejo/workflows/container.yml
@@ -4,9 +4,6 @@ on:
   workflow_dispatch: {}
   push: {}
 
-permissions:
-  packages: write
-
 jobs:
   build-container:
     name: Build Container
@@ -14,24 +11,38 @@ jobs:
     container:
       image: ghcr.io/osscontainertools/kaniko:alpine
     steps:
-      - name: Install NodeJS for actions compatibility
-        run: apk add --no-cache nodejs
+      - name: Install required system packages compatibility
+        run: apk add --no-cache nodejs skopeo
+
       - name: Checkout source code
         uses: actions/checkout@v6
+
       - name: Login to container registry (prod only)
         if: ${{ forgejo.ref_name == 'main' }}
-        run: /kaniko/executor login --username="forgejo-actions" --password="${{ forgejo.token }}" git.hamburg.ccc.de
+        run: /kaniko/executor login --username="forgejo-actions" --password="${{ secrets.PACKAGES_TOKEN }}" git.hamburg.ccc.de
+
+      - run: |
+          echo "--- cating file ---"
+          cat /root/.docker/config.json
+          echo "--- end of file ---"
+
       - name: Build Container
-        env:
-          KANIKO_NO_PUSH: ${{ forgejo.ref_name != 'main' }}
+        # env:
+        #   KANIKO_NO_PUSH: ${{ forgejo.ref_name != 'main' }}
         run: /kaniko/executor
           --dockerfile="${{forgejo.workspace }}/Containerfile"
           --context="dir://${{ forgejo.workspace }}"
           --destination=git.hamburg.ccc.de/ccchh/dooris:latest
-          --credential-helpers=env
+          --tar-path=${{ forgejo.workspace }}/image.tar
+          --no-push
           --no-push-cache
           --annotation=org.opencontainers.image.ref.name=dooris
           --annotation=org.opencontainers.image.url=${{ forgejo.server_url }}/${{ forgejo.repository }}
           --annotation=org.opencontainers.image.source=${{ forgejo.server_url }}/${{ forgejo.repository }}
           --annotation=org.opencontainers.image.licenses=AGPL-3.0
 
+      - name: Push Container
+        if: ${{ forgejo.ref_name == 'main' }}
+        run: |
+          skopeo copy "docker-archive:${{ forgejo.workspace }}/image.tar" docker://git.hamburg.ccc.de/ccchh/dooris:latest --dest-creds="forgejo-actions:${{ secrets.PACKAGES_TOKEN }}"
+