Pousser l'image P7 avec un PAT write:package (secret PACKAGE_TOKEN).

Le GITHUB_TOKEN du job se logue au registry mais le push est refusé (reqPackageAccess).

.github/workflows/cd.yml

@@ -43,7 +43,8 @@ jobs:
         run: |
           set -eu
           REGISTRY="${GITHUB_SERVER_URL#https://}"
-          echo "${{ secrets.GITHUB_TOKEN }}" | docker login "${REGISTRY}" -u "${GITHUB_ACTOR}" --password-stdin
+          # GITHUB_TOKEN : login OK mais push → unauthorized: reqPackageAccess
+          echo "${{ secrets.PACKAGE_TOKEN }}" | docker login "${REGISTRY}" -u "${GITHUB_ACTOR}" --password-stdin
 
       - name: Build and push
         run: |