Use a public auth token instead of the CI token, which requires a sep…

…arate login step for a GHCR token
wappuradio · Apr 12, 2024 · 8a9f799 · 8a9f799
1 parent 4df9800
commit 8a9f799
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 11 deletions.
diff --git a/.github/workflows/prod.yml b/.github/workflows/prod.yml
@@ -28,20 +28,20 @@ jobs:
           import json
           import base64
 
+          with urllib.request.urlopen('https://ghcr.io/token?scope=repository:wappuradio/webbi:pull') as f:
+              token = json.load(f)['token']
+
           req = urllib.request.Request(
               'https://ghcr.io/v2/wappuradio/webbi/tags/list',
-              headers={
-                'Authorization': 'Basic ' + base64.b64encode(sys.argv[1].encode()).decode()
-              }
+              headers={'Authorization': f'Bearer {token}'}
           )
 
           with urllib.request.urlopen(req) as f:
-              if sys.argv[2] in json.load(f)['tags']:
+              if sys.argv[1] in json.load(f)['tags']:
                   print('exists=true')
               else:
                   print('exists=false')" \
           \
-          "${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}" \
           "${{ github.sha }}" \
           >> $GITHUB_OUTPUT
 

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -28,20 +28,20 @@ jobs:
           import json
           import base64
 
+          with urllib.request.urlopen('https://ghcr.io/token?scope=repository:wappuradio/webbi:pull') as f:
+              token = json.load(f)['token']
+
           req = urllib.request.Request(
-              'https://ghcr.io/v2/wappuradio/webbi/tags/list', 
-              headers={
-                'Authorization': 'Basic ' + base64.b64encode(sys.argv[1].encode()).decode()
-              }
+              'https://ghcr.io/v2/wappuradio/webbi/tags/list',
+              headers={'Authorization': f'Bearer {token}'}
           )
 
           with urllib.request.urlopen(req) as f:
-              if sys.argv[2] in json.load(f)['tags']:
+              if sys.argv[1] in json.load(f)['tags']:
                   print('exists=true')
               else:
                   print('exists=false')" \
           \
-          "${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}" \
           "${{ github.sha }}" \
           >> $GITHUB_OUTPUT