Merge pull request #125 from anoadragon453/HarHarLinks/fix-ci

Update CI fixing GHCR permissions
anoadragon453 · Jan 4, 2024 · 3632ef1 · 3632ef1
2 parents 436cb89 + 20e44a2
commit 3632ef1
Showing 1 changed file with 13 additions and 20 deletions.
diff --git a/.github/workflows/ghcr.yml b/.github/workflows/ghcr.yml
@@ -15,18 +15,14 @@ jobs:
   docker-build-python-versions-matrix:
     strategy:
       matrix:
-        version: ['3.8', '3.9', '3.10', '3.11', '3.12']
+        version: ['3.8', '3.9', '3.10', '3.11']
         arch: ['linux/amd64', 'linux/arm64']
       fail-fast: false
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
-        with:
-          # required for changesets
-          fetch-depth: '0'
-          # don't persist the credentials so the changesets action doesn't use the
-          # github actions token but the git token provided via environment variable
-          persist-credentials: false
 
       - name: Setup buildx
         uses: docker/setup-buildx-action@v3
@@ -46,23 +42,13 @@ jobs:
 
   docker-build-push-ghcr:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     outputs:
       docker-tag: ${{ steps.meta.outputs.version }}
     steps:
       - uses: actions/checkout@v4
-        with:
-          # required for changesets
-          fetch-depth: '0'
-          # don't persist the credentials so the changesets action doesn't use the
-          # github actions token but the git token provided via environment variable
-          persist-credentials: false
-
-      - name: Login to ghcr.io
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Generate Docker metadata
         id: meta
@@ -82,6 +68,13 @@ jobs:
         with:
           platforms: linux/amd64,linux/arm64
 
+      - name: Login to ghcr.io
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Docker build and push
         uses: docker/build-push-action@v5
         id: dockerBuild