From fa40edb680e61acc5d55ef211bbddd4577676b39 Mon Sep 17 00:00:00 2001
From: pc-heini <hoaxlp@gmail.com>
Date: Tue, 7 Jul 2026 02:48:14 +0200
Subject: [PATCH] ci: use the existing user-wide REGISTRY_TOKEN for repo access

The default GITHUB_TOKEN is scoped to this repo only and cannot clone the
private upstream HeiniRemote. Reuse the user-wide write PAT (REGISTRY_TOKEN)
that the other repos' actions already rely on, instead of requiring a new
per-repo secret.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .gitea/workflows/build-flatpak.yml | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/build-flatpak.yml b/.gitea/workflows/build-flatpak.yml
index ae74418..cb67e8a 100644
--- a/.gitea/workflows/build-flatpak.yml
+++ b/.gitea/workflows/build-flatpak.yml
@@ -50,9 +50,15 @@ jobs:
 
       # Plain git clone instead of actions/checkout@v4: the bare ubuntu image
       # has no Node.js, so JavaScript actions fail with exit 127.
+      #
+      # REGISTRY_TOKEN is the user-wide write PAT the other repos' actions
+      # already use. It is required (not just preferred): the auto-provided
+      # GITHUB_TOKEN is scoped to THIS repo only, so it cannot clone the
+      # private upstream HeiniRemote. The GITHUB_TOKEN fallback exists just so
+      # the own-repo steps still work if the secret is ever unset.
       - name: Checkout
         env:
-          TOKEN: ${{ secrets.PUBLISH_TOKEN != '' && secrets.PUBLISH_TOKEN || secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
         run: |
           AUTH_URL="$(echo "${GITHUB_SERVER_URL}" | sed "s#://#://${GITHUB_ACTOR}:${TOKEN}@#")/${GITHUB_REPOSITORY}.git"
           git init -q
@@ -64,7 +70,7 @@ jobs:
       - name: Resolve upstream HeiniRemote version
         id: ver
         env:
-          TOKEN: ${{ secrets.PUBLISH_TOKEN != '' && secrets.PUBLISH_TOKEN || secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
         run: |
           chmod +x scripts/*.sh
           export UPSTREAM_URL="$(echo "${GITHUB_SERVER_URL}" | sed "s#://#://${GITHUB_ACTOR}:${TOKEN}@#")/pc-heini/HeiniRemote.git"
@@ -100,7 +106,7 @@ jobs:
       - name: Build agent from upstream source
         if: steps.check.outputs.build == 'true'
         env:
-          TOKEN: ${{ secrets.PUBLISH_TOKEN != '' && secrets.PUBLISH_TOKEN || secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
         run: |
           UPSTREAM_URL="$(echo "${GITHUB_SERVER_URL}" | sed "s#://#://${GITHUB_ACTOR}:${TOKEN}@#")/pc-heini/HeiniRemote.git"
           # init+fetch instead of clone: works for tags and bare commit shas alike.
@@ -151,7 +157,7 @@ jobs:
       - name: Publish OSTree repo to the 'pages' branch
         if: steps.check.outputs.build == 'true'
         env:
-          TOKEN: ${{ secrets.PUBLISH_TOKEN != '' && secrets.PUBLISH_TOKEN || secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
         run: |
           AUTH_URL="$(echo "${{ github.server_url }}" | sed "s#://#://${{ github.actor }}:${TOKEN}@#")/${{ github.repository }}.git"
           rm -rf publish && mkdir publish && cd publish
@@ -169,7 +175,7 @@ jobs:
       - name: Tag and release the published version
         if: steps.check.outputs.build == 'true'
         env:
-          TOKEN: ${{ secrets.PUBLISH_TOKEN != '' && secrets.PUBLISH_TOKEN || secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
           GITEA_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
         run: |
           AUTH_URL="$(echo "${{ github.server_url }}" | sed "s#://#://${{ github.actor }}:${TOKEN}@#")/${{ github.repository }}.git"