Repository navigation
ci: Use a dedicated token for the Docker Hub description - #19
Merged
Merged
Conversation
Updating the description failed with "Forbidden": DOCKER_PERSONAL_KEY only has the "Read & Write" scope, which is enough to push images but not to edit the repository page, which needs "Read, Write, Delete". Use a separate DOCKERHUB_DESCRIPTION_TOKEN secret so the build jobs keep a token that can't delete anything, and fail with an explicit message when the secret is missing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QTN7At86i5TYDmozENSNv8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Docker Hub description sync added in #18 failed with
Forbidden. Login works, but thePATCHto the repository page is rejected.DOCKER_PERSONAL_KEYhas the Read & Write scope, which is enough to push images. Editing the repository page needs Read, Write, Delete.Instead of widening the token every build job uses, this workflow now reads its own secret,
DOCKERHUB_DESCRIPTION_TOKEN. That way the build jobs never hold a token that can delete images. If the secret is missing, the job fails with an explicit message instead of a bareForbidden.Required setup
DOCKERHUB_DESCRIPTION_TOKENrepository secret.Testing
actionlint passes. After merging, the workflow runs on
mainand will fail at "Check token" until the secret exists. Once the secret is set, re-run it withworkflow_dispatch.🤖 Generated with Claude Code
https://claude.ai/code/session_01QTN7At86i5TYDmozENSNv8