From 05c4ebe52686565289fefeaa515cf3414111f396 Mon Sep 17 00:00:00 2001
From: Olaf <github@dacht.net>
Date: Tue, 25 Aug 2026 21:44:46 +0200
Subject: [PATCH] Gitea Actions improvement

---
 .gitea/workflows/development.yml |  2 +-
 .gitea/workflows/release.yml     | 12 ++++++------
 README.md                        |  4 ++--
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.gitea/workflows/development.yml b/.gitea/workflows/development.yml
index 6bacb8b..6744832 100644
--- a/.gitea/workflows/development.yml
+++ b/.gitea/workflows/development.yml
@@ -21,7 +21,7 @@ jobs:
         with:
           registry: git.kolkman.org
           username: ${{ secrets.REGISTRY_USERNAME }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and publish development image
         uses: docker/build-push-action@v6
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 4ab28aa..dfc2f27 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -32,7 +32,7 @@ jobs:
         with:
           registry: git.kolkman.org
           username: ${{ secrets.REGISTRY_USERNAME }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and publish Docker image
         uses: docker/build-push-action@v6
@@ -49,12 +49,12 @@ jobs:
       - name: Create Gitea release
         id: gitea_release
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
           VERSION: ${{ steps.release.outputs.version }}
         run: |
           response=$(curl --fail-with-body --silent --show-error \
             -X POST \
-            -H "Authorization: token $GITEA_TOKEN" \
+            -H "Authorization: token $RELEASE_TOKEN" \
             -H 'Content-Type: application/json' \
             -d "{\"tag_name\":\"v$VERSION\",\"name\":\"LinkLog $VERSION\",\"draft\":false,\"prerelease\":false}" \
             https://git.kolkman.org/api/v1/repos/olaf/Link-Log/releases)
@@ -66,17 +66,17 @@ jobs:
 
       - name: Upload signed XPI and update manifest
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
           UPLOAD_URL: ${{ steps.gitea_release.outputs.upload_url }}
           VERSION: ${{ steps.release.outputs.version }}
         run: |
           curl --fail-with-body --silent --show-error \
-            -X POST -H "Authorization: token $GITEA_TOKEN" \
+            -X POST -H "Authorization: token $RELEASE_TOKEN" \
             -H 'Content-Type: application/x-xpinstall' \
             --data-binary "@XPI/signed/LinkLog-$VERSION.xpi" \
             "$UPLOAD_URL?name=LinkLog-$VERSION.xpi"
           curl --fail-with-body --silent --show-error \
-            -X POST -H "Authorization: token $GITEA_TOKEN" \
+            -X POST -H "Authorization: token $RELEASE_TOKEN" \
             -H 'Content-Type: application/json' \
             --data-binary @webextension/updates.json \
             "$UPLOAD_URL?name=updates.json"
diff --git a/README.md b/README.md
index 164b88a..3e5d49f 100644
--- a/README.md
+++ b/README.md
@@ -112,9 +112,9 @@ The signed XPI is produced manually and must be checked into `XPI/signed/LinkLog
 
 The extension's `update_url` points at the stable raw repository URL `https://git.kolkman.org/olaf/Link-Log/raw/branch/main/webextension/updates.json`. Update `webextension/updates.json` with each signed XPI version and commit it together with the XPI. The release page provides a direct install link at `https://git.kolkman.org/olaf/Link-Log/releases/download/v<version>/LinkLog-<version>.xpi`.
 
-The workflow requires Gitea Actions secrets named `REGISTRY_USERNAME`, `REGISTRY_PASSWORD`, and `GITEA_TOKEN`. The token needs permission to create releases and upload release assets; the registry credentials need permission to push the image.
+The workflow requires Gitea Actions secrets named `REGISTRY_USERNAME`, `REGISTRY_TOKEN`, and `RELEASE_TOKEN`. `REGISTRY_TOKEN` is a Gitea access token with permission to push packages; `RELEASE_TOKEN` needs permission to create releases and upload release assets.
 
-Every push to `main` also runs `.gitea/workflows/development.yml` and publishes the current Docker image as `git.kolkman.org/olaf/link-log:development`. The workflow uses the same `REGISTRY_USERNAME` and `REGISTRY_PASSWORD` secrets and can also be started manually from Gitea Actions.
+Every push to `main` also runs `.gitea/workflows/development.yml` and publishes the current Docker image as `git.kolkman.org/olaf/link-log:development`. The workflow uses `REGISTRY_USERNAME` and the Gitea access token in `REGISTRY_TOKEN`, and can also be started manually from Gitea Actions.
 
 Appending a username to the root URL, such as `/alice`, opens that user's public feed and profile information.