go-audit-clean-tick

Answer

Root cause (why login passes but push dies with insufficient_scope): docker login ghcr.io validates token identity only. Authorization (write:packages on the target namespace) is enforced at push time. So a token that is valid-but-under-scoped logs in cleanly and fails on docker push — and since your gh secret list + job-step metadata already proved GH_PAT is delivered and the login step succeeded, secret delivery is ruled out. The remaining causes, in order of likelihood: (1) PAT lacks package-write scope, (2) fine-grained PAT missing Packages: Read+write or wrong resource owner, (3) image namespace ≠ token's resource owner, (4) org "Package creation" restricted to admins and the PAT user isn't one, (5) SSO not authorized.

Fix 1 — zero-PAT (recommended for same-owner pushes): use the auto-generated GITHUB_TOKEN with packages: write. No human step, no PAT drift:

permissions:
  contents: read
  packages: write

jobs:
  build-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}   # NOT a PAT
      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}:latest
            ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

Key details baked in: push to github.repository_owner namespace (never github.actor), fully-lowercase refs (GHCR denies uppercase/mismatched namespace even with a valid PAT), and type=gha cache so no extra registry scope is needed for cache.

Fix 2 — PAT path (required for cross-org push, or if the org enforces read-only workflow permissions). Human-gated once: create a classic PAT with write:packages (+ repo only if the build pulls private source) and authorize SSO for the org; or a fine-grained PAT with Packages: Read and write, resource owner = the org, repository access = the target repo. Then gh secret set GH_PAT --repo owner/repo --body "$(cat pat.txt)".

Fix 3 — make the pipeline self-diagnosing (kills the empty --log-failed cron problem): probe the GHCR OAuth endpoint before docker push so the failure reason lands in the step log/job summary even when logs expire or --log-failed returns nothing. Full patched workflow written and linted at /tmp/audit37/.github/workflows/release.yml, with the preflight step:

      - name: Preflight - verify GHCR push scope (fails fast, works in cron)
        env:
          GH_PAT: ${{ secrets.GH_PAT }}
          IMAGE: ${{ github.repository_owner }}/${{ github.event.repository.name }}
        run: |
          set -euo pipefail
          code=$(curl -s -o /tmp/tok.json -w '%{http_code}' \
            -u "ci:$GH_PAT" \
            "https://ghcr.io/token?scope=repository:${IMAGE}:pull,push")
          case "$code" in
            200) scope=$(jq -r '.scope // "none"' /tmp/tok.json)
                 case "$scope" in
                   *push*) echo "GHCR push scope OK for ${IMAGE}" >> "$GITHUB_STEP_SUMMARY" ;;
                   *) echo "::error::GH_PAT lacks write:packages. Granted: ${scope}." >&2; exit 1 ;;
                 esac ;;
            *)   echo "::error::GH_PAT rejected (HTTP ${code}): invalid/expired/SSO." >&2; exit 1 ;;
          esac

Plus a runnable, daemon-free local checker at /tmp/audit37/verify-ghcr-scope.sh (GH_PAT=<token> ./verify-ghcr-scope.sh <owner> <image>), so the human can validate a new PAT in 2 seconds without Docker.