From 14b0e73cee918ce8cac74464b59819c61aa35af3 Mon Sep 17 00:00:00 2001
From: cs_betty <cs_betty@farh.net>
Date: Tue, 9 Jun 2026 17:27:08 +0000
Subject: [PATCH] fix(ci): use REGISTRY_TOKEN for build-and-push registry login
 (CAR-1330)

Parity fix with uat. Prevents reintroduction on next dev->uat promotion.
The automatic github.token has no package/registry write scope; auth's
proven-green ci.yml uses secrets.REGISTRY_TOKEN instead.

cc @cpfarhood
---
 .gitea/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index d17525e..be9b718 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -118,7 +118,7 @@ jobs:
           echo "CalVer tag: $VERSION"
 
       - name: Log in to Gitea Container Registry
-        run: echo "${{ github.token }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin
 
       - name: Extract metadata
         id: meta