3 Commits

Include renames

Author	SHA1	Message	Date
JakeBreath	7cecfeabc6	Use a minimal registry PAT and the job token for releases ... Gitea's container registry rejects the automatic job token (go-gitea/gitea#23642 is still open), so the image push keeps a PAT with only the write:package scope; a preflight step fails clearly when the REGISTRY_USER/REGISTRY_TOKEN secrets are missing. Release creation needs no PAT: the desktop job asks for contents: write on the job token.	2026-09-22 23:35:55 -05:00
JakeBreath	ed6178d12e	Make Actions token permissions explicit ... The automatic job token creates the desktop release, so the CD desktop job asks for contents: write; the images job keeps contents: read and asks for packages: write so the job token can stand in for the scoped registry PAT. CI stays read-only. The registry token itself remains a write:package-only PAT (verified login + pull).	2026-09-22 23:30:37 -05:00
JakeBreath	8f9656ac0e	Add the manual CD release workflow ... One dispatch builds and pushes both images and builds the desktop packages into a Gitea release (desktop-v<version>, installers + latest*.yml attached, idempotent on re-run). The live update feed stays a deploy-host operation: CI has no SSH key for jakerasp, so push_desktop.sh --no-build remains the way to publish it. Repo secrets REGISTRY_USER/REGISTRY_TOKEN are set, so the image push uses the Gitea registry credentials directly.	2026-09-22 23:23:05 -05:00