From 4ea17cbac26d42188ae79e787957787faa7094da Mon Sep 17 00:00:00 2001
From: Lucas Rayan <lucas.guerra@pop-pe.rnp.br>
Date: Sun, 1 Nov 2026 21:44:15 -0300
Subject: [PATCH] ci: volta ao secret REGISTRY_TOKEN para publicar no registro

O registro do Gitea recusa o token do job (unauthorized).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .gitea/workflows/ci.yml      | 2 +-
 .gitea/workflows/release.yml | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 01c1c08..f31f05d 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -83,7 +83,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ gitea.actor }}
-          password: ${{ gitea.token }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       # `docker build` simples, no daemon persistente do runner: as camadas e o
       # cache mount do npm sobrevivem entre execuções. Um buildx criaria um
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 052f210..ca23c6b 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -2,6 +2,8 @@ name: Release
 
 # Publica a imagem no registro de containers do Gitea depois de um merge em main,
 # e de novo com tag semver quando uma tag v* é enviada. O servidor só faz pull.
+# Precisa do secret REGISTRY_TOKEN no repositório (token do Gitea com write:package):
+# o registro recusa o token do job.
 on:
   push:
     branches: [main]
@@ -63,7 +65,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ gitea.actor }}
-          password: ${{ gitea.token }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Metadados
         id: meta