From 95060ddf950fa9ad3e49ea9f979c77eb58f953c7 Mon Sep 17 00:00:00 2001
From: pc-heini <admin@pc-heini.de>
Date: Tue, 7 Jul 2026 13:19:20 +0200
Subject: [PATCH] =?UTF-8?q?ci:=20split=20tokens=20=E2=80=94=20GITHUB=5FTOK?=
 =?UTF-8?q?EN=20for=20own=20repo,=20read-only=20PAT=20for=20upstream?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The package-scoped REGISTRY_TOKEN cannot clone repos (403). Own-repo
operations (checkout, pages push, tag, release) now use the auto-provided
GITHUB_TOKEN; the private upstream clone uses the new read-only secret
HeiniRemoteFlatpakActionReleases.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .gitea/workflows/build-flatpak.yml | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/.gitea/workflows/build-flatpak.yml b/.gitea/workflows/build-flatpak.yml
index cb67e8a..018be1a 100644
--- a/.gitea/workflows/build-flatpak.yml
+++ b/.gitea/workflows/build-flatpak.yml
@@ -51,14 +51,13 @@ jobs:
       # Plain git clone instead of actions/checkout@v4: the bare ubuntu image
       # has no Node.js, so JavaScript actions fail with exit 127.
       #
-      # REGISTRY_TOKEN is the user-wide write PAT the other repos' actions
-      # already use. It is required (not just preferred): the auto-provided
-      # GITHUB_TOKEN is scoped to THIS repo only, so it cannot clone the
-      # private upstream HeiniRemote. The GITHUB_TOKEN fallback exists just so
-      # the own-repo steps still work if the secret is ever unset.
+      # Token split: the auto-provided GITHUB_TOKEN covers everything in THIS
+      # repo (checkout, pages push, tag, release). HeiniRemoteFlatpakActionReleases
+      # — a read-only PAT (repository: read) — is only needed where the private
+      # upstream HeiniRemote is cloned, which GITHUB_TOKEN cannot reach.
       - name: Checkout
         env:
-          TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           AUTH_URL="$(echo "${GITHUB_SERVER_URL}" | sed "s#://#://${GITHUB_ACTOR}:${TOKEN}@#")/${GITHUB_REPOSITORY}.git"
           git init -q
@@ -70,7 +69,7 @@ jobs:
       - name: Resolve upstream HeiniRemote version
         id: ver
         env:
-          TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.HeiniRemoteFlatpakActionReleases }}
         run: |
           chmod +x scripts/*.sh
           export UPSTREAM_URL="$(echo "${GITHUB_SERVER_URL}" | sed "s#://#://${GITHUB_ACTOR}:${TOKEN}@#")/pc-heini/HeiniRemote.git"
@@ -106,7 +105,7 @@ jobs:
       - name: Build agent from upstream source
         if: steps.check.outputs.build == 'true'
         env:
-          TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.HeiniRemoteFlatpakActionReleases }}
         run: |
           UPSTREAM_URL="$(echo "${GITHUB_SERVER_URL}" | sed "s#://#://${GITHUB_ACTOR}:${TOKEN}@#")/pc-heini/HeiniRemote.git"
           # init+fetch instead of clone: works for tags and bare commit shas alike.
@@ -157,7 +156,7 @@ jobs:
       - name: Publish OSTree repo to the 'pages' branch
         if: steps.check.outputs.build == 'true'
         env:
-          TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           AUTH_URL="$(echo "${{ github.server_url }}" | sed "s#://#://${{ github.actor }}:${TOKEN}@#")/${{ github.repository }}.git"
           rm -rf publish && mkdir publish && cd publish
@@ -175,7 +174,7 @@ jobs:
       - name: Tag and release the published version
         if: steps.check.outputs.build == 'true'
         env:
-          TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITEA_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
         run: |
           AUTH_URL="$(echo "${{ github.server_url }}" | sed "s#://#://${{ github.actor }}:${TOKEN}@#")/${{ github.repository }}.git"