build / Build and push image (push) Successful in 1m45s
The automatic token is rejected by the package registry regardless of the permissions the job requests, so the push uses a personal access token scoped to package read and write. The job no longer asks for packages: write, since nothing it does with the automatic token touches the registry.