include glyph sdk to release build

.gitea/workflows/docker.yml

@@ -15,13 +15,14 @@ on:
     branches: [master]
     tags: ["v*"]
 
-# The built-in job token is enough to push to this instance's own registry; a
-# REGISTRY_TOKEN secret is only needed when it is not (an older Gitea, or a
-# restricted default permission mode). Ask for packages: write explicitly so the
-# token is not silently read-only on instances that default to restricted.
+# The built-in job token (`secrets.GITEA_TOKEN`) **cannot** publish packages on
+# Gitea — `permissions:` has no effect on container pushes, and the job token is
+# read-only there by design. Publishing therefore needs a personal access token
+# with `package:write`, stored as REGISTRY_TOKEN. Without it the image is still
+# built and smoke-tested, but not pushed; that keeps the build honest without
+# failing every push on a repository that has not minted a token yet.
 permissions:
   contents: read
-  packages: write
 
 env:
   REGISTRY: git.timka.su
@@ -37,23 +38,27 @@ jobs:
         run: docker version
 
       - name: Log in to the Gitea registry
+        id: login
         env:
           # The username is only needed to pair with the token. Default it to the
           # repository owner — the same account the image namespace belongs to —
           # so a missing REGISTRY_USER secret does not fail the job with docker's
           # unhelpful "username is empty".
           REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.repository_owner }}
-          # Gitea gives every job a built-in token (secrets.GITEA_TOKEN). Prefer
-          # an explicit secret, but fall back to that token so a fresh repository
-          # publishes without anyone having to mint one by hand.
-          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || secrets.GITEA_TOKEN }}
+          # A personal access token with `package:write`. The built-in job token
+          # is not usable here: Gitea's job token is read-only for packages (its
+          # `permissions:` support does not cover the container registry yet),
+          # so falling back to it only produces a confusing 401.
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           if [ -z "$REGISTRY_USER" ] || [ -z "$REGISTRY_TOKEN" ]; then
-            echo "::error::Container registry credentials are missing. Set REGISTRY_TOKEN (a token with package:write) under Settings → Actions → Secrets; REGISTRY_USER is optional and defaults to the repository owner."
-            exit 1
+            echo "::warning::No REGISTRY_TOKEN (a personal access token with package:write) — the image will be built and smoke-tested but not pushed. Add it under Settings → Actions → Secrets to publish."
+            echo "push=false" >> "$GITHUB_OUTPUT"
+            exit 0
           fi
           printf '%s' "$REGISTRY_TOKEN" \
             | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+          echo "push=true" >> "$GITHUB_OUTPUT"
 
       - name: Build
         run: |
@@ -80,12 +85,13 @@ jobs:
           docker rm -f kadence-smoke
 
       - name: Push
+        if: steps.login.outputs.push == 'true'
         run: |
           docker push "$IMAGE:$SHORT"
           docker push "$IMAGE:latest"
 
       - name: Push the tag, when there is one
-        if: startsWith(github.ref, 'refs/tags/v')
+        if: steps.login.outputs.push == 'true' && startsWith(github.ref, 'refs/tags/v')
         run: |
           VERSION="${GITHUB_REF#refs/tags/}"
           docker tag "$IMAGE:$SHORT" "$IMAGE:$VERSION"