Use scoped token for VPS image pulls

[gocanto]

Summary

• grant the VPS deploy job read-only access to linked GHCR packages
• authenticate the remote Docker pull with the run-scoped GitHub token
• remove the deploy path's dependency on the rejected long-lived registry secret

Evidence

The two latest production runs built and published both images, then failed before changing the VPS with Get "https://ghcr.io/v2/": denied: denied. The publishing job already proves this repository is linked to the packages.

The next push to main will exercise the complete production deployment.

Summary by CodeRabbit

• Chores
  • Improved deployment authentication for pulling container images.
  • Added the required read-only package permission to the deployment process.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 30 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6e85c948-9a6d-43fa-8299-22ebac908e73

📥 Commits

Reviewing files that changed from the base of the PR and between ed43900 and c8616d7.

📒 Files selected for processing (1)

• .github/workflows/deploy.yml

Walkthrough

The deployment workflow grants the VPS job read access to packages and changes GHCR Docker authentication to use GITHUB_TOKEN.

Changes

GHCR deployment authentication

Layer / File(s)	Summary
Update deployment permissions and registry login .github/workflows/deploy.yml	The deploy-to-vps job grants packages: read, and its GHCR login uses secrets.GITHUB_TOKEN.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• oullin/infra#1: Introduced the deployment workflow updated by this PR.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: switching VPS image pulls to a scoped GitHub token.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/deploy.yml:
- Around line 65-66: Add a brief YAML comment immediately above the permissions
block documenting that packages: read is required for GHCR pulls and all other
token permissions are intentionally disabled; leave the existing permission
scope unchanged.
- Line 80: Update the deployment step containing the remote docker login so
GITHUB_TOKEN and the GitHub actor are passed through appleboy/ssh-action’s
env/envs mechanism rather than interpolated in the SSH script. Reference both
values as quoted shell variables inside the remote command while preserving the
existing ghcr.io login behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: c4102a04-b7ad-436f-8e12-5083d6cab416

📥 Commits

Reviewing files that changed from the base of the PR and between cee9193 and ed43900.

📒 Files selected for processing (1)

• .github/workflows/deploy.yml