use separate jobs for go-releaser and ghcr push, fix permissions

.github/workflows/release.yml

@@ -1,9 +1,5 @@
 name: goreleaser
 
-env:
-  REGISTRY: ghcr.io  # default is docker.io
-  IMAGE_NAME: ${{ github.repository }}
-
 on:
   push:
     tags:
@@ -12,12 +8,12 @@ on:
     branches:
       - pal-goes-ghcr
 
-permissions:
-  contents: write
-
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/') # todo remove, currently disabled for branch push
+    permissions:
+      contents: write  # for go-releaser binaries
     steps:
       -
         name: Checkout
@@ -34,23 +30,32 @@ jobs:
            echo "VAULTPAL_VERSION=${GITHUB_REF#refs/*/}" >> "$GITHUB_ENV"
       -
         name: Run GoReleaser
-        if: startsWith(github.ref, 'refs/tags/') # todo remove, currently disabled for branch push
         uses: goreleaser/goreleaser-action@v4
         with:
           distribution: goreleaser
           version: latest
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  ghcrpush:
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write  # for container registry
+    env:
+      REGISTRY: ghcr.io  # default is docker.io
+      IMAGE_NAME: ${{ github.repository }}
+    steps:
       -
-        name: Login to GitHub Container Registry
-        uses: docker/login-action@v1
+        name: Checkout
+        uses: actions/checkout@v3
         with:
-          registry: ${{ env.REGISTRY }}
-          #  You can use the ${{ github.actor }} context to automatically use the username of the user that triggered the workflow run.
-          username: ${{ github.actor }}
-          # You can use the automatically-generated GITHUB_TOKEN secret for the password
-          password: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+      -
+        name: Set Variables used in build-args for docker build
+        run: |
+          echo "VAULTPAL_COMMIT=$(git rev-parse --short "$GITHUB_SHA")" >> $GITHUB_ENV
+          echo "VAULTPAL_VERSION=${GITHUB_REF#refs/*/}" >> "$GITHUB_ENV"
       -
         name: Extract metadata (tags, labels) for Docker
         id: meta
@@ -60,6 +65,15 @@ jobs:
       -
         name: Set up Docker Buildx for Multiple platform builds
         uses: docker/[email protected]
+      -
+        name: Login to GitHub Container Registry
+        uses: docker/login-action@v1
+        with:
+          registry: ${{ env.REGISTRY }}
+          #  You can use the ${{ github.actor }} context to automatically use the username of the user that triggered the workflow run.
+          username: ${{ github.actor }}
+          # You can use the automatically-generated GITHUB_TOKEN secret for the password
+          password: ${{ secrets.GITHUB_TOKEN }}
       -
         name: Build and push Docker image
         uses: docker/[email protected]