From a3b77414d8486f4f32ce86741f2a8a40ff3a7f22 Mon Sep 17 00:00:00 2001
From: Justin Paul <justin@jpaul.me>
Date: Fri, 29 May 2026 18:00:29 -0400
Subject: [PATCH] CI: use REGISTRY_TOKEN secret for registry login

The auto Actions token can't push packages in this Gitea; use a PAT secret.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .gitea/workflows/ci.yml | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 4278d5f..cf5c6f0 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -34,13 +34,10 @@ jobs:
     runs-on: docker
     steps:
       - uses: actions/checkout@v4
-      # Auth to the Gitea container registry. The auto-provisioned job token
-      # works for the repo owner's package namespace in the common config; if a
-      # run ever fails here with a permissions error, add a repo Actions secret
-      # REGISTRY_TOKEN (a PAT with write:package) and swap secrets.GITHUB_TOKEN
-      # for secrets.REGISTRY_TOKEN below.
+      # The auto-provisioned Actions token cannot push packages in this Gitea,
+      # so use a PAT (write:package) stored as the REGISTRY_TOKEN repo secret.
       - name: Log in to registry
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login git.jpaul.io -u "${{ github.actor }}" --password-stdin
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.jpaul.io -u "${{ github.actor }}" --password-stdin
       - name: Build + push
         run: |
           docker build -t "$IMAGE:latest" -t "$IMAGE:${{ github.sha }}" .