fix: Gitea Actions secrets — DEPLOY_TOKEN replaces reserved GITEA_ prefix

Gitea reserves the GITEA_ prefix for Actions secrets, so
secrets.GITEA_TOKEN resolved to empty, causing 401 on all package
uploads in pkg-supply-chain workflow.

- Rename CI secret from GITEA_TOKEN to DEPLOY_TOKEN (env var stays
  GITEA_TOKEN for code compatibility)
- Add provision_gitea_actions() to provisioning system — syncs
  DEPLOY_TOKEN, REGISTRY_USER, REGISTRY_TOKEN to Gitea Actions
- Wired into both provision() and bootstrap() flows
- All 7 Gitea Actions workflows updated

Refs #229, refs #230

.gitea/workflows/ci.yml

@@ -38,7 +38,7 @@ jobs:
       - name: File failure issue
         if: failure()
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: |
           uv sync --no-dev --quiet 2>/dev/null || true
           uv run python -m api.diag.ci \
@@ -76,7 +76,7 @@ jobs:
       - name: File failure issue
         if: failure()
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: |
           uv sync --no-dev --quiet 2>/dev/null || true
           uv run python -m api.diag.ci \

.gitea/workflows/deploy.yml

@@ -92,7 +92,7 @@ jobs:
 
       - name: Report vulnerabilities
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: |
           uv sync --no-dev
           for f in notebooks-scan.json zotero-scan.json docs-scan.json api-scan.json; do
@@ -102,7 +102,7 @@ jobs:
       - name: File failure issue
         if: failure()
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: |
           uv sync --no-dev --quiet 2>/dev/null || true
           uv run python -m api.diag.ci \

.gitea/workflows/harden.yml

@@ -90,7 +90,7 @@ jobs:
 
       - name: Close resolved or file new vuln issues
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: |
           uv sync --no-dev
           for f in notebooks-scan.json zotero-scan.json docs-scan.json api-scan.json; do
@@ -103,7 +103,7 @@ jobs:
       - name: File failure issue
         if: failure()
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: |
           uv sync --no-dev --quiet 2>/dev/null || true
           uv run python -m api.diag.ci \

.gitea/workflows/infra-ci.yml

@@ -53,7 +53,7 @@ jobs:
       - name: File failure issue
         if: failure()
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: |
           uv sync --no-dev --quiet 2>/dev/null || true
           uv run python -m api.diag.ci \
@@ -81,7 +81,7 @@ jobs:
       - name: File failure issue
         if: failure()
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: |
           uv sync --no-dev --quiet 2>/dev/null || true
           uv run python -m api.diag.ci \
@@ -109,7 +109,7 @@ jobs:
       - name: File failure issue
         if: failure()
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: |
           uv sync --no-dev --quiet 2>/dev/null || true
           uv run python -m api.diag.ci \
@@ -137,7 +137,7 @@ jobs:
       - name: File failure issue
         if: failure()
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: |
           uv sync --no-dev --quiet 2>/dev/null || true
           uv run python -m api.diag.ci \
@@ -165,7 +165,7 @@ jobs:
       - name: File failure issue
         if: failure()
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: |
           uv sync --no-dev --quiet 2>/dev/null || true
           uv run python -m api.diag.ci \

.gitea/workflows/pkg-supply-chain.yml

@@ -38,7 +38,7 @@ jobs:
 
       - name: Sync to Gitea package registry
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: uv run python dev/scripts/pkg_mirror_sync.py
 
       - name: Drift detection
@@ -54,13 +54,13 @@ jobs:
 
       - name: Auto-create issues for drift and vulns
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: uv run python dev/scripts/pkg_issues.py
 
       - name: File failure issue
         if: failure()
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: |
           uv sync --no-dev --quiet 2>/dev/null || true
           uv run python -m api.diag.ci \

.gitea/workflows/rebuild-all.yml

@@ -91,7 +91,7 @@ jobs:
 
       - name: Report vulnerabilities
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: |
           uv sync --no-dev
           for f in notebooks-scan.json zotero-scan.json docs-scan.json api-scan.json; do
@@ -101,7 +101,7 @@ jobs:
       - name: File failure issue
         if: failure()
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: |
           uv sync --no-dev --quiet 2>/dev/null || true
           uv run python -m api.diag.ci \

.gitea/workflows/release.yml

@@ -32,7 +32,7 @@ jobs:
       - name: File failure issue
         if: failure()
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: |
           uv sync --no-dev --quiet 2>/dev/null || true
           uv run python -m api.diag.ci \

dev/scripts/backends/gitea.py

@@ -107,7 +107,7 @@ def _failure_step(workflow_name: str, job_name: str) -> str:
       - name: File failure issue
         if: failure()
         env:
-          GITEA_TOKEN: ${{{{ secrets.GITEA_TOKEN }}}}
+          GITEA_TOKEN: ${{{{ secrets.DEPLOY_TOKEN }}}}
         run: |
           uv sync --no-dev --quiet 2>/dev/null || true
           uv run python -m api.diag.ci \\
@@ -254,7 +254,7 @@ jobs:
 
       - name: Report vulnerabilities
         env:
-          GITEA_TOKEN: ${{{{ secrets.GITEA_TOKEN }}}}
+          GITEA_TOKEN: ${{{{ secrets.DEPLOY_TOKEN }}}}
         run: |
           uv sync --no-dev
           for f in {vuln_files}; do
@@ -320,7 +320,7 @@ jobs:
 
       - name: Close resolved or file new vuln issues
         env:
-          GITEA_TOKEN: ${{{{ secrets.GITEA_TOKEN }}}}
+          GITEA_TOKEN: ${{{{ secrets.DEPLOY_TOKEN }}}}
         run: |
           uv sync --no-dev
           for f in {vuln_files}; do
@@ -390,7 +390,7 @@ jobs:
 
       - name: Report vulnerabilities
         env:
-          GITEA_TOKEN: ${{{{ secrets.GITEA_TOKEN }}}}
+          GITEA_TOKEN: ${{{{ secrets.DEPLOY_TOKEN }}}}
         run: |
           uv sync --no-dev
           for f in {vuln_files}; do

src/api/auth/provision.py

@@ -328,6 +328,50 @@ def provision_woodpecker(
     wp.close()
 
 
+# ── Gitea Actions secret sync ──────────────────────────────────
+
+# Gitea reserves the GITEA_ prefix for Actions secrets, so the token
+# is stored as DEPLOY_TOKEN and mapped to GITEA_TOKEN env var in workflows.
+GITEA_ACTIONS_SECRET_MAP = {
+    "DEPLOY_TOKEN": "GITEA_TOKEN",
+    "REGISTRY_USER": "GITEA_ADMIN_USER",
+    "REGISTRY_TOKEN": "GITEA_ADMIN_PASSWORD",
+}
+
+
+def provision_gitea_actions(
+    values: dict[str, str],
+    *,
+    owner: str = "homelab",
+    repo: str = "stack",
+) -> None:
+    """Sync rotated credentials to Gitea Actions repo secrets."""
+    token = values.get("GITEA_TOKEN", "")
+    if not token:
+        raise ValueError("GITEA_TOKEN not available for Actions secret sync")
+
+    from api.clients.gitea import GiteaClient
+
+    client = GiteaClient(token)
+    base = f"/repos/{owner}/{repo}/actions/secrets"
+
+    for secret_name, env_var in GITEA_ACTIONS_SECRET_MAP.items():
+        val = values.get(env_var, "")
+        if not val:
+            log.warning("Skipping Actions secret %s — no value", secret_name)
+            continue
+        try:
+            resp = client.put(f"{base}/{secret_name}", json={"data": val})
+            status = resp.status_code
+            if status in (201, 204):
+                log.info("Set Actions secret: %s", secret_name)
+            else:
+                log.warning("Actions secret %s returned %d", secret_name, status)
+        except Exception:
+            log.exception("Failed to set Actions secret: %s", secret_name)
+    client.close()
+
+
 # ── Main entry points ───────────────────────────────────────────
 
 
@@ -372,6 +416,13 @@ def provision(
             result.errors.append(("woodpecker", e))
             log.error("Woodpecker secret sync failed: %s", e)
 
+        try:
+            _retry(lambda: provision_gitea_actions(values), "gitea-actions")
+            log.info("Gitea Actions secrets synced")
+        except Exception as e:
+            result.errors.append(("gitea-actions", e))
+            log.error("Gitea Actions secret sync failed: %s", e)
+
     write_env(values, env_path)
     result.env_written = True
     log.info("Wrote %d credentials to %s", len(values), env_path)
@@ -413,6 +464,13 @@ def bootstrap(
             result.errors.append(("woodpecker", e))
             log.error("Woodpecker bootstrap failed: %s", e)
 
+        try:
+            provision_gitea_actions(values)
+            log.info("Gitea Actions secrets synced")
+        except Exception as e:
+            result.errors.append(("gitea-actions", e))
+            log.error("Gitea Actions secret sync failed: %s", e)
+
     write_env(values, env_path)
     result.env_written = True
     return result