From 886c9831c38f0053cb0959a0f7680c668003b7cb Mon Sep 17 00:00:00 2001
From: Celes Renata <celes@frameshift.net>
Date: Sat, 18 Apr 2026 10:12:48 +0000
Subject: [PATCH] fix: pass GHCR_TOKEN to integration-test for image pull auth
 + add packages:read permission

---
 .github/workflows/build.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c315c56..f11cfb7 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -175,6 +175,9 @@ jobs:
     needs: [build-services, build-dashboard]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: self-hosted-gremlin
+    permissions:
+      contents: read
+      packages: read
     steps:
       - uses: actions/checkout@v5
 
@@ -214,6 +217,8 @@ jobs:
           kubectl cluster-info || echo "WARNING: kubectl cannot reach cluster API"
 
       - name: Run integration tests
+        env:
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           bash infra/inttest/run_pipeline.sh \
             --image-tag ${{ github.sha }} \