scope docker credentials

.gitea/workflows/build.yaml

@@ -7,7 +7,7 @@ on:
 env:
   ENDPOINT: services-3
   STACK: mastodon
-  IMAGE: mastodon/mastobot
+  IMAGE: docker/mastobot
   TAG: ${{ gitea.ref_name }}
   CACHE_NAME: cache-python-dependencies-mastobot
   RUNNER_TOOL_CACHE: /toolcache
@@ -31,6 +31,8 @@ jobs:
           registry: ${{ secrets.DOCKER_REGISTRY }}
           username: ${{ secrets.DOCKER_REGISTRY_USER }}
           password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
+          scope: ${{secrets.DOCKER_REGISTRY}}/${{env.IMAGE}}@push
+          logout: true
       - name: Build and push Docker image
         uses: docker/build-push-action@v6
         with: