From 7b9683715405f505f5d02983a7bd8a7aa5585c05 Mon Sep 17 00:00:00 2001
From: root <root@hz-prod.tailbb0454.ts.net>
Date: Wed, 1 Jul 2026 09:50:56 +0000
Subject: [PATCH] grant packages:write for registry push

---
 .forgejo/workflows/build.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 945650e..fdf0602 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -6,7 +6,9 @@
 #   - repo Secrets:  COSIGN_PRIVATE_KEY, COSIGN_PASSWORD, COSIGN_PUBLIC_KEY
 name: spike-build
 on: [push, workflow_dispatch]
-permissions: {}
+permissions:
+  contents: read
+  packages: write        # required to push the image to Forgejo's registry
 env:
   REGISTRY: ${{ vars.FORGEJO_REGISTRY }}
 jobs: