ci: use RELEASE_TOKEN + publish to packages registry

- Release step now authenticates with the RELEASE_TOKEN Actions secret
  (repo write) instead of the automatic token; drop the now-unneeded
  permissions block.
- Add a step that publishes the skill zip to the Gitea generic packages
  registry (cycling-training-skill@<tag>) using the REGISTRY_TOKEN secret,
  handling 200/201/409 responses.
- README: document the registry download URL and both secrets.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TqrhBhC3GEcKyaw8RTk8G6

.gitea/workflows/release-skill.yml

@@ -5,12 +5,13 @@ name: Package skill
 #   - Push a tag  v*   -> builds the zip AND attaches it to a Gitea release.
 #   - Run manually     -> builds the zip and uploads it as a run artifact.
 #
-# Requirements on the Gitea side:
+# Requirements on the Gitea side (already provisioned):
 #   * A registered Actions runner (image with bash/zip/curl, e.g. catthehacker/ubuntu).
 #   * Actions enabled for this repo (Settings > Actions).
-#   * The automatic ${{ secrets.GITHUB_TOKEN }} must have contents:write so the
-#     release step can create the release / upload the asset (granted via the
-#     `permissions` block below on Gitea >= 1.20).
+#   * Actions secrets:
+#       - RELEASE_TOKEN  : token with repo write, used to create the release + upload the asset.
+#       - REGISTRY_TOKEN : token with package write, used to publish the zip to the
+#                          Gitea generic packages registry.
 
 on:
   push:
@@ -26,8 +27,6 @@ on:
 jobs:
   package:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -54,7 +53,7 @@ jobs:
       - name: Attach zip to release
         if: github.ref_type == 'tag'
         env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.RELEASE_TOKEN }}
           SERVER: ${{ github.server_url }}
           REPO: ${{ github.repository }}
           VERSION: ${{ steps.ver.outputs.version }}
@@ -88,3 +87,28 @@ jobs:
             -F "attachment=@${ZIP}" \
             "${SERVER}/api/v1/repos/${REPO}/releases/${REL_ID}/assets?name=$(basename "${ZIP}")"
           echo "Attached $(basename "${ZIP}") to release ${VERSION} (id ${REL_ID})."
+
+      - name: Publish zip to Gitea packages registry
+        if: github.ref_type == 'tag'
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          SERVER: ${{ github.server_url }}
+          OWNER: ${{ github.repository_owner }}
+          VERSION: ${{ steps.ver.outputs.version }}
+        run: |
+          set -euo pipefail
+          ZIP="$(ls dist/*.zip | head -1)"
+          FILE="$(basename "${ZIP}")"
+          PACKAGE="cycling-training-skill"
+          URL="${SERVER}/api/packages/${OWNER}/generic/${PACKAGE}/${VERSION}/${FILE}"
+          echo "Uploading ${FILE} to generic package ${PACKAGE}@${VERSION}"
+          CODE="$(curl -sS -o /tmp/reg_resp.txt -w '%{http_code}' -X PUT \
+            -H "Authorization: token ${REGISTRY_TOKEN}" \
+            --upload-file "${ZIP}" \
+            "${URL}")"
+          echo "HTTP ${CODE}"; cat /tmp/reg_resp.txt 2>/dev/null || true; echo
+          case "${CODE}" in
+            200|201) echo "Published ${FILE} to packages registry." ;;
+            409) echo "Version ${VERSION} already present in registry — skipping." ;;
+            *) echo "ERROR: registry upload failed (HTTP ${CODE})" >&2; exit 1 ;;
+          esac

README.md

@@ -70,6 +70,10 @@ the zip one of two ways, then import it in **Settings → Skills**:
 
 - **From a release:** download `cycling-training-<version>.zip` from the repo's Releases (produced
   automatically — see *Packaging & releases* below).
+- **From the packages registry:** the same zip is published to the Gitea generic packages registry:
+  ```
+  https://git.farh.net/api/packages/farhoodlabs/generic/cycling-training-skill/<version>/cycling-training-<version>.zip
+  ```
 - **Build it yourself:**
   ```bash
   scripts/build-skill-zip.sh v1.0.0   # -> dist/cycling-training-v1.0.0.zip
@@ -84,14 +88,14 @@ pairs with your connected Intervals.icu MCP server for the live data.
 `dist/cycling-training-<version>.zip` (validating that `SKILL.md` carries `name`/`description`
 frontmatter). A Gitea Actions workflow, `.gitea/workflows/release-skill.yml`, runs it:
 
-- **Push a tag `v*`** (e.g. `git tag v1.0.0 && git push origin v1.0.0`) → builds the zip and
-  **attaches it to a Gitea release** for that tag.
+- **Push a tag `v*`** (e.g. `git tag v1.0.0 && git push origin v1.0.0`) → builds the zip,
+  **attaches it to a Gitea release** for that tag, and **publishes it to the packages registry**.
 - **Run the workflow manually** (workflow_dispatch) → builds the zip and uploads it as a run
   artifact you can download.
 
-The workflow needs a registered Actions runner, Actions enabled for the repo, and the automatic
-`GITHUB_TOKEN` to have `contents:write` (granted via the workflow's `permissions` block on
-Gitea ≥ 1.20).
+The workflow uses two Actions secrets: `RELEASE_TOKEN` (repo write — creates the release and
+uploads the asset) and `REGISTRY_TOKEN` (package write — publishes to the generic packages
+registry). A registered Actions runner and Actions-enabled repo are also required.
 
 ## How to read the docs