From 93b018882633cedfc9c5c41cb9dcf1b36ce549a9 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Sat, 29 Aug 2026 22:53:26 -0700
Subject: [PATCH] fix: use REGISTRY_PAT secret for git auth (exists on all
 repos)

---
 .gitea/workflows/ci.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index b4dc45a..7c6153e 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -32,9 +32,9 @@ jobs:
       # path to trust in the first place.
       - name: checkout
         env:
-          GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
         run: |
-          url=$(echo "${GITHUB_SERVER_URL}" | sed -E "s#(https?://)#\1x-access-token:${GIT_TOKEN}@#")
+          url=$(echo "${GITHUB_SERVER_URL}" | sed -E "s#(https?://)#\1x-access-token:${REGISTRY_PAT}@#")
           git clone "${url}/${GITHUB_REPOSITORY}.git" .
           git checkout "${GITHUB_SHA}"
 
@@ -53,9 +53,9 @@ jobs:
       # Same reason as the buf job: golang:1.25 has no Node.js either.
       - name: checkout
         env:
-          GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
         run: |
-          url=$(echo "${GITHUB_SERVER_URL}" | sed -E "s#(https?://)#\1x-access-token:${GIT_TOKEN}@#")
+          url=$(echo "${GITHUB_SERVER_URL}" | sed -E "s#(https?://)#\1x-access-token:${REGISTRY_PAT}@#")
           git clone "${url}/${GITHUB_REPOSITORY}.git" .
           git checkout "${GITHUB_SHA}"