Fix Publish workflow write_package permission denied on GHCR - #158
Merged
Conversation
Add org.opencontainers.image.source OCI label to all three service Dockerfiles so GHCR automatically links container packages to the repository. Without this label, packages pushed by GITHUB_TOKEN may not be associated with the repository, causing write_package permission denied errors. Also set fail-fast: false on the publish matrix so all three image builds are attempted independently. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add
org.opencontainers.image.sourceOCI label to all three service Dockerfiles so GHCR automatically links container packages to the repository. Without this label, packages pushed byGITHUB_TOKENare not associated with the repository, causingwrite_packagepermission denied errors.Also set
fail-fast: falseon the publish matrix so all three image builds are attempted independently — a failure in one image should not cancel the others.Changes
services/mysql-server/Dockerfile: Addorg.opencontainers.image.sourceOCI labelservices/mysql-mgmt/Dockerfile: Addorg.opencontainers.image.sourceOCI labelservices/superset/Dockerfile: Addorg.opencontainers.image.sourceOCI label.github/workflows/publish.yml: Addfail-fast: falseto strategy matrixCHANGELOG.md: Document the fixNote
If the GHCR packages already exist but are not linked to the repository, they must be manually connected via each package's settings page (Manage Actions access → add
superset-clusterwith Write role), or deleted so they can be recreated with proper linking on the next push.Closes #157