From 44a89d9c6190e548c753e4ce2477c974dcab9a5c Mon Sep 17 00:00:00 2001
From: cs_betty <cs_betty@farh.net>
Date: Tue, 9 Jun 2026 17:26:39 +0000
Subject: [PATCH] fix(ci): use REGISTRY_TOKEN for build-and-push registry login
 (CAR-1330)

Unblocks CAR-1132 production deploy. The automatic github.token has no
package/registry write scope; auth's proven-green ci.yml uses
secrets.REGISTRY_TOKEN instead.

cc @cpfarhood
---
 .gitea/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index d17525e..be9b718 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -118,7 +118,7 @@ jobs:
           echo "CalVer tag: $VERSION"
 
       - name: Log in to Gitea Container Registry
-        run: echo "${{ github.token }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin
 
       - name: Extract metadata
         id: meta