Merge pull request 'fix(ci): build dev images without repository write access' (#221) from dev into main

Reviewed-on: #221

.gitea/workflows/build-push.yaml

@@ -30,8 +30,8 @@ jobs:
         with:
           ref: ${{ github.sha }}
           fetch-depth: 0
-          # Prefer repository secrets; retain the existing variable during migration.
-          token: ${{ secrets.RELEASE_TOKEN || secrets.CI_TOKEN || vars.CI_TOKEN }}
+          # dev uses the normal read-only checkout; only main needs a release writer.
+          token: ${{ github.ref == 'refs/heads/main' && (secrets.RELEASE_TOKEN || vars.RELEASE_TOKEN || vars.CI_TOKEN || secrets.CI_TOKEN) || github.token }}
       - uses: actions/setup-node@v4
         with:
           node-version: '22'
@@ -41,13 +41,14 @@ jobs:
         with:
           registry: git.federspiel.tech
           username: flfeders
-          password: ${{ secrets.CI_TOKEN || vars.CI_TOKEN }}
+          # Same credential source as the existing image-build workflows.
+          password: ${{ vars.CI_TOKEN || secrets.CI_TOKEN }}
       - name: Build all images and publish main releases
-        # Gitea 1.25 ignores concurrency. ci.mjs uses an atomic Git ref lock instead.
+        # main uses a Git ref lock. dev only reads Git and writes to the registry.
         env:
           CI: 'true'
           FEDEO_REF: ${{ github.ref }}
           FEDEO_SHA: ${{ github.sha }}
           FEDEO_EVENT_NAME: ${{ github.event_name }}
-          GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.CI_TOKEN || vars.CI_TOKEN }}
+          GITEA_TOKEN: ${{ github.ref == 'refs/heads/main' && (secrets.RELEASE_TOKEN || vars.RELEASE_TOKEN || vars.CI_TOKEN || secrets.CI_TOKEN) || '' }}
         run: npm run release:ci