From 8468c2f869bfab2af5a4873509d3f2a590631eac Mon Sep 17 00:00:00 2001 From: Samuel K Date: Mon, 27 Jul 2026 00:23:04 -0500 Subject: [PATCH 1/2] ci(agent-helper): drop unused packages:write, bump image to 1.0.0 The GHCR publish authenticates via the GitHub App token, not GITHUB_TOKEN, so the packages:write job permission was unused. The org package now exists (bootstrapped by a first manual push), so App-token pushes succeed once the App is granted write access to the package. Bumps images/agent-helper/VERSION to 1.0.0. --- .github/workflows/publish-agent-helper.yml | 1 - images/agent-helper/VERSION | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/publish-agent-helper.yml b/.github/workflows/publish-agent-helper.yml index 841385e67..2dbc4dadb 100644 --- a/.github/workflows/publish-agent-helper.yml +++ b/.github/workflows/publish-agent-helper.yml @@ -28,7 +28,6 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - packages: write steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 diff --git a/images/agent-helper/VERSION b/images/agent-helper/VERSION index 6e8bf73aa..3eefcb9dd 100644 --- a/images/agent-helper/VERSION +++ b/images/agent-helper/VERSION @@ -1 +1 @@ -0.1.0 +1.0.0 From 82282e349bc51afcbaca2ea1e77eeb842459dc96 Mon Sep 17 00:00:00 2001 From: Samuel K Date: Mon, 27 Jul 2026 00:44:13 -0500 Subject: [PATCH 2/2] ci(agent-helper): publish via GITHUB_TOKEN instead of GitHub App token The GitHub App cannot be granted write access to the org container package, so switch GHCR auth to the built-in GITHUB_TOKEN with packages:write. This is the standard method and lets the package be published under the repo. Drops the create-github-app-token step and restores packages:write. --- .github/workflows/publish-agent-helper.yml | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) diff --git a/.github/workflows/publish-agent-helper.yml b/.github/workflows/publish-agent-helper.yml index 2dbc4dadb..e7a759192 100644 --- a/.github/workflows/publish-agent-helper.yml +++ b/.github/workflows/publish-agent-helper.yml @@ -28,6 +28,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + packages: write steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 @@ -51,21 +52,13 @@ jobs: - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 # Publish on push to main / manual dispatch; pull_request runs build-only. - - name: generate GitHub App token - id: app-token - if: ${{ github.event_name != 'pull_request' }} - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 - with: - app-id: ${{ secrets.DEVSY_GITHUB_APP_ID }} - private-key: ${{ secrets.DEVSY_GITHUB_APP_PRIVATE_KEY }} - - name: log in to ghcr if: ${{ github.event_name != 'pull_request' }} uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1 with: registry: ghcr.io - username: ${{ steps.app-token.outputs.app-slug }} - password: ${{ steps.app-token.outputs.token }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} - name: check tag exists id: exists