Problem

The metadata step was only setting image_repo to the repository owner (e.g., chaptersix) instead of the full registry path (ghcr.io/chaptersix). This caused Docker to try pushing to Docker Hub instead of GHCR, resulting in:

ERROR: failed to solve: failed to fetch oauth token: unexpected status from GET request to https://auth.docker.io/token?scope=repository%3Achaptersix%2Ftemporal-cli%3Apull%2Cpush&service=registry.docker.io: 401 Unauthorized

Solution

Updated the metadata step in .github/workflows/build-and-publish.yml to include the ghcr.io/ prefix for non-temporalio forks:

if [[ "$REPO_OWNER" == "temporalio" ]]; then
  echo "image_repo=temporalio" >> $GITHUB_OUTPUT
else
  echo "image_repo=ghcr.io/$REPO_OWNER" >> $GITHUB_OUTPUT
fi

This ensures the IMAGE_REPO environment variable passed to docker-bake has the full registry path.

Testing

After merging, create a new release to verify images are published to ghcr.io/chaptersix/temporal-cli.