The Stratos release workflows build the all-in-one container image successfully but cannot push it: denied: permission_denied: write_package for ghcr.io/cloudfoundry/stratos. Login succeeds; authorization fails.
The package predates the current workflows (its only tag, stable, was pushed over 5 years ago), so it carries its own legacy permissions and the repository was never granted access to it. GITHUB_TOKEN with packages: write therefore can't push, and no credential in the repo can fix that. Full diagnosis in cloudfoundry/stratos#5763.
Since package access sits outside the org-management automation in this repo, this needs an org admin:
On https://github.com/orgs/cloudfoundry/packages/container/stratos/settings, under Manage Actions access, add the cloudfoundry/stratos repository with the Write role.
No new credential or secret is involved — once granted, the existing workflows publish as-is, and release runs stop reporting failure for an otherwise-successful release.
@stephanme @Gerg — filing here per the repo conventions since this isn't coverable by a PR to the org yaml; happy to adjust if there's a better route.
The Stratos release workflows build the all-in-one container image successfully but cannot push it:
denied: permission_denied: write_packageforghcr.io/cloudfoundry/stratos. Login succeeds; authorization fails.The package predates the current workflows (its only tag,
stable, was pushed over 5 years ago), so it carries its own legacy permissions and the repository was never granted access to it.GITHUB_TOKENwithpackages: writetherefore can't push, and no credential in the repo can fix that. Full diagnosis in cloudfoundry/stratos#5763.Since package access sits outside the org-management automation in this repo, this needs an org admin:
On https://github.com/orgs/cloudfoundry/packages/container/stratos/settings, under Manage Actions access, add the
cloudfoundry/stratosrepository with the Write role.No new credential or secret is involved — once granted, the existing workflows publish as-is, and release runs stop reporting failure for an otherwise-successful release.
@stephanme @Gerg — filing here per the repo conventions since this isn't coverable by a PR to the org yaml; happy to adjust if there's a better route.