.forgejo/workflows/release.yml

@@ -6,14 +6,10 @@
 # publishes a Forgejo release via rasterstate/forgejo-release-action and
 # uploads the APK as an asset.
 #
-# Authentication uses ${{ secrets.GITHUB_TOKEN }} (auto-provided by the
+# Authentication uses ${{ secrets.RELEASE_TOKEN }}, a Forgejo PAT scoped
-# Forgejo runner, scoped to contents: write for the current repo). A
+# to `write:repository` configured in the repository's Actions secrets.
-# dedicated PAT (${{ secrets.RELEASE_TOKEN }}) was the preferred option
+# The runner-provided ${{ secrets.GITHUB_TOKEN }} would also work, but
-# for least-privilege, but creating repo-level secrets is currently
+# a dedicated PAT is preferred for least-privilege and revocability.
-# broken on this Forgejo instance (InsertEncryptedSecret fails with a
-# UTF-8 byte-sequence error, probably a text-vs-bytea column type on
-# the secret table). Bumping to Forgejo v16 should fix it; until then,
-# the runner-provided token keeps the workflow operational.
 #
 # This workflow complements .github/workflows/docker-publish-android.yml
 # which targets the GitHub mirror; the validate-release logic mirrors
@@ -228,4 +224,4 @@ jobs:
           files: |
             PostIt.Android.apk
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}