From 7820f138f62c7f67fcd189719a9e39e61fbe7954 Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Sat, 10 Oct 2026 04:56:55 +0400
Subject: [PATCH] ci: read registry token from FJ_TOKEN

Forgejo no longer allows creating secrets prefixed FORGEJO_, so the
regenerated registry token (the old one got 401 reqPackageAccess on
push) has to live under a new name.

Assisted-by: Claude:opus-5
---
 .forgejo/workflows/deploy.yaml | 2 +-
 CLAUDE.md                      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows/deploy.yaml b/.forgejo/workflows/deploy.yaml
index 3cdde54..eacaa88 100644
--- a/.forgejo/workflows/deploy.yaml
+++ b/.forgejo/workflows/deploy.yaml
@@ -66,7 +66,7 @@ jobs:
 
           # Auth Conf
           mkdir -p /kaniko/.docker
-          echo "{\"auths\":{\"${{ secrets.FORGEJO_REGISTRY }}\":{\"auth\":\"$(echo -n ${{ secrets.FORGEJO_USER }}:${{ secrets.FORGEJO_TOKEN }} | base64)\"}}}" > /kaniko/.docker/config.json
+          echo "{\"auths\":{\"${{ secrets.FORGEJO_REGISTRY }}\":{\"auth\":\"$(echo -n ${{ secrets.FORGEJO_USER }}:${{ secrets.FJ_TOKEN }} | base64)\"}}}" > /kaniko/.docker/config.json
 
           # Build & push
           /kaniko/executor \
diff --git a/CLAUDE.md b/CLAUDE.md
index c2d9679..af6d8e3 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -181,7 +181,7 @@ All colors in `public/style.css` are CSS custom properties on `:root` (design to
 | `CRYPTO_ADDRESSES`       | JSON object (`CryptoAsset` code => payout address) prefilled per coin into the new-invoice form | Not confidential (printed on invoices + QR), but kept as a secret so rotation is a one-place change. Update secret + push. Existing invoices keep their captured address. |
 | `LTC_ADDRESS`            | Legacy: fills the LTC default when `CRYPTO_ADDRESSES` has no LTC entry  | Same as above. Can be folded into `CRYPTO_ADDRESSES` and removed.                                |
 | `DEPLOY_IP/USER/SSH_KEY` | SSH to prod from CI                                                      | Standard SSH key rotation.                                                                       |
-| `FORGEJO_REGISTRY/USER/TOKEN` | Kaniko registry auth                                                | Forgejo token rotation.                                                                          |
+| `FORGEJO_REGISTRY/USER`, `FJ_TOKEN` | Kaniko registry auth. Token needs `write:package` + `read:repository`; named `FJ_` because Forgejo forbids new secrets prefixed `FORGEJO_` | Forgejo token rotation.                                                                          |
 
 **Non-secret config that lives in the workflow** (not in `.env.example`, not in secrets): `SMTP_ADDR`, `SMTP_PORT`, `SMTP_USER`, `MAIL_FROM`, `MAIL_TO`, `DATABASE_URL` host portion, `S3_ENDPOINT`, `S3_PUBLIC_ENDPOINT`, `S3_REGION`, `S3_BUCKET`. Change these by editing `.forgejo/workflows/deploy.yaml`.