From e41cd3c6f0c1f98a0638efa913e277d6a7fc2a29 Mon Sep 17 00:00:00 2001
From: Barcode Betty <32+cs_betty@noreply.git.farh.net>
Date: Tue, 9 Jun 2026 17:46:32 +0000
Subject: [PATCH] fix(ci): use REGISTRY_TOKEN for build-and-push registry login
 (CAR-1330)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Squashed fix swaps github.token → secrets.REGISTRY_TOKEN at .gitea/workflows/ci.yml:121, matching the proven-green cartsnitch/auth pattern (CAR-1009). Unblocks CAR-1132 production deploy by making the build-and-push job pass registry auth.

QA: PR #49 approved by @cs_charlie (review id 4615); CI run 3439 lint/typecheck/test all green.
Co-authored-by: Barcode Betty <32+cs_betty@noreply.git.farh.net>
Co-committed-by: Barcode Betty <32+cs_betty@noreply.git.farh.net>
---
 .gitea/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index d17525e..be9b718 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -118,7 +118,7 @@ jobs:
           echo "CalVer tag: $VERSION"
 
       - name: Log in to Gitea Container Registry
-        run: echo "${{ github.token }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin
 
       - name: Extract metadata
         id: meta