Add Docker login to GHCR before pushing images

[wkoszek]

Docker push is failing because we're not authenticated to GitHub Container Registry (ghcr.io) before GoReleaser tries to push images.

Error

unauthorized: unauthenticated: User cannot be authenticated with the token provided.
The push refers to repository [ghcr.io/bsubio/cli]

Root Cause

The credentials: in the workflow's container: section only authenticates pulling the CI container image. It doesn't log Docker in for pushing images.

container:
  credentials:
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

This authenticates the container pull but doesn't run docker login.

Solution

Add a Docker login step before running GoReleaser:

- name: Log in to GitHub Container Registry
  if: github.ref == 'refs/heads/main' && github.event_name == 'push'
  uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

This must run after setting up Buildx and before GoReleaser executes.