Hi @riebl, can you approve me as contributor for allowing workflow runs? :)
Thanks!

Looks like build & push needs additional permissions to update the runner image. I think it might be a bad practice to update this image globally (i.e. effectively every new PR will push & pull image from the same place), but, unfortunately, I see no other way we may implement this conveniently.

@riebl, may you grant package update permission?

I have already checked that the package is linked to this repository. Not sure yet how to solve this issue properly.

Not sure if this helps, but this worked for me:

• go to packages page, then open package settings
• set permissions to write

(on picture is my fork)

Yes, I have the same settings here. Maybe it is a limitation when a pull request triggers an action, but I don't know for sure.

Yeah, I think my branch is foreign to your repository and does not have write permissions :)

I will separate the container creation from the CI: Build container only on push to master branch, run CI on push and pull requests. Then no write access is required when running CI for pull requests.

Okay, the described change is live :-) Please rebase your PR and let's see what will happen!