actions: login via GITEA_TOKEN to package repository not working

[krombel]

Description

I am having this snippet in a workflow file:

      - name: Log in to the Container registry
        uses: docker/login-action@v2
        with:
          registry: my.gitea.domain
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITEA_TOKEN }}

I exchanged github.repository_owner with github.actor as well. Bot did not work.

I see the following error in the actions run log:

Log in to the Container registry
Logging into my.gitea.domain...
::error::Error response from daemon: login attempt to https://my.gitea.domain/v2/ failed with status: 401 Unauthorized

Gitea Version

1.19.0

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

I am running it in a docker container and am reverse proxying the https port.

Database

None

[dboreham]

Token scope was added in 1.19 so perhaps your token needs to be re-issued with a new scope (this happened to me in a slightly different context but where I could see the full error response from gitea which mentioned the token scope being inadequate).

[lunny]

Did you set your ROOT_RUL in app.ini to my.gitea.domain ?

[krombel]

Token scope was added in 1.19 so perhaps your token needs to be re-issued with a new scope (this happened to me in a slightly different context but where I could see the full error response from gitea which mentioned the token scope being inadequate).

@dboreham How do you do that? As far as I understood that specific token is a task defined token which would not affect any secrets I have defined myself.

gitea/routers/api/actions/runner/utils.go

Line 70 in be93e48

secrets["GITEA_TOKEN"] = task.Token

Did you set your ROOT_RUL in app.ini to my.gitea.domain ?

I think there is a typo 😉 . I set ROOT_URL at least to https://my.gitea.domain

[KN4CK3R]

Does it work from the command line? docker login -u ... -p token my.gitea.domain

[krombel]

The package repository itself is working. When I try to use a pregenerated secret and use that, it is working as well. What is not working ist the use of the GITEA_TOKEN to publish data into the package repository.

[yp05327]

401 Unauthorized is returned by ReqContainerAccess (defined in routers/api/packages/container/container.go)

I removed container.ReqContainerAccess here, it returns success.(not a fix, just a test)

gitea/routers/api/packages/api.go

Line 460 in d02e83a

r.Get("", container.ReqContainerAccess, container.DetermineSupport)

[KN4CK3R]

Just a note: That looks like it works but you can't upload a container or other things.