Gitea Actions improvement

.gitea/workflows/development.yml

@@ -21,7 +21,7 @@ jobs:
         with:
           registry: git.kolkman.org
           username: ${{ secrets.REGISTRY_USERNAME }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and publish development image
         uses: docker/build-push-action@v6

.gitea/workflows/release.yml

@@ -32,7 +32,7 @@ jobs:
         with:
           registry: git.kolkman.org
           username: ${{ secrets.REGISTRY_USERNAME }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and publish Docker image
         uses: docker/build-push-action@v6
@@ -49,12 +49,12 @@ jobs:
       - name: Create Gitea release
         id: gitea_release
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
           VERSION: ${{ steps.release.outputs.version }}
         run: |
           response=$(curl --fail-with-body --silent --show-error \
             -X POST \
-            -H "Authorization: token $GITEA_TOKEN" \
+            -H "Authorization: token $RELEASE_TOKEN" \
             -H 'Content-Type: application/json' \
             -d "{\"tag_name\":\"v$VERSION\",\"name\":\"LinkLog $VERSION\",\"draft\":false,\"prerelease\":false}" \
             https://git.kolkman.org/api/v1/repos/olaf/Link-Log/releases)
@@ -66,17 +66,17 @@ jobs:
 
       - name: Upload signed XPI and update manifest
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
           UPLOAD_URL: ${{ steps.gitea_release.outputs.upload_url }}
           VERSION: ${{ steps.release.outputs.version }}
         run: |
           curl --fail-with-body --silent --show-error \
-            -X POST -H "Authorization: token $GITEA_TOKEN" \
+            -X POST -H "Authorization: token $RELEASE_TOKEN" \
             -H 'Content-Type: application/x-xpinstall' \
             --data-binary "@XPI/signed/LinkLog-$VERSION.xpi" \
             "$UPLOAD_URL?name=LinkLog-$VERSION.xpi"
           curl --fail-with-body --silent --show-error \
-            -X POST -H "Authorization: token $GITEA_TOKEN" \
+            -X POST -H "Authorization: token $RELEASE_TOKEN" \
             -H 'Content-Type: application/json' \
             --data-binary @webextension/updates.json \
             "$UPLOAD_URL?name=updates.json"

README.md

@@ -112,9 +112,9 @@ The signed XPI is produced manually and must be checked into `XPI/signed/LinkLog
 
 The extension's `update_url` points at the stable raw repository URL `https://git.kolkman.org/olaf/Link-Log/raw/branch/main/webextension/updates.json`. Update `webextension/updates.json` with each signed XPI version and commit it together with the XPI. The release page provides a direct install link at `https://git.kolkman.org/olaf/Link-Log/releases/download/v<version>/LinkLog-<version>.xpi`.
 
-The workflow requires Gitea Actions secrets named `REGISTRY_USERNAME`, `REGISTRY_PASSWORD`, and `GITEA_TOKEN`. The token needs permission to create releases and upload release assets; the registry credentials need permission to push the image.
+The workflow requires Gitea Actions secrets named `REGISTRY_USERNAME`, `REGISTRY_TOKEN`, and `RELEASE_TOKEN`. `REGISTRY_TOKEN` is a Gitea access token with permission to push packages; `RELEASE_TOKEN` needs permission to create releases and upload release assets.
 
-Every push to `main` also runs `.gitea/workflows/development.yml` and publishes the current Docker image as `git.kolkman.org/olaf/link-log:development`. The workflow uses the same `REGISTRY_USERNAME` and `REGISTRY_PASSWORD` secrets and can also be started manually from Gitea Actions.
+Every push to `main` also runs `.gitea/workflows/development.yml` and publishes the current Docker image as `git.kolkman.org/olaf/link-log:development`. The workflow uses `REGISTRY_USERNAME` and the Gitea access token in `REGISTRY_TOKEN`, and can also be started manually from Gitea Actions.
 
 Appending a username to the root URL, such as `/alice`, opens that user's public feed and profile information.