Forgejo auto-injects GITHUB_TOKEN secret. Use FORGEJO_TOKEN env var for clarity since we're retiring GitHub.