ahmza.com/mcpacks
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Split registry and GitOps credentials
Publish Packwiz site / publish (push) Successful in 1m30s
Details

Browse Source
This commit is contained in:
ahmza
2026-09-04 12:52:25 +00:00
parent a41e119720
commit 70cb26e762
2 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/README.md
+7 -4
View File
@@ -182,11 +182,14 @@ The workflow finally commits that image's immutable OCI digest to
Argo CD notices that commit and performs the rollout; the workflow does not
hold Kubernetes credentials or change the cluster directly.
The Gitea Actions repository secret `GITEATOKEN` must belong to `ci-bot`
and be able to:
The publishing workflow uses two Gitea Actions repository secrets belonging
to `ci-bot`:
- push packages owned by the `ahmza.com` organization
- read and write `ahmza.com/k8s-starter-pack`
- `REGISTRY_TOKEN` can push packages owned by the `ahmza.com` organization
- `GITOPS_TOKEN` can read and write `ahmza.com/k8s-starter-pack`
Keeping these credentials separate ensures that the package token cannot modify
Git repositories and the GitOps token cannot publish packages.
The `latest` image tag exists only to bootstrap the first Argo CD sync and for
human inspection. Normal rollouts use the exact content digest recorded in the