Split registry and GitOps credentials

.gitea/README.md

@@ -182,11 +182,14 @@ The workflow finally commits that image's immutable OCI digest to
 Argo CD notices that commit and performs the rollout; the workflow does not
 hold Kubernetes credentials or change the cluster directly.
 
-The Gitea Actions repository secret `GITEATOKEN` must belong to `ci-bot`
-and be able to:
+The publishing workflow uses two Gitea Actions repository secrets belonging
+to `ci-bot`:
 
-- push packages owned by the `ahmza.com` organization
-- read and write `ahmza.com/k8s-starter-pack`
+- `REGISTRY_TOKEN` can push packages owned by the `ahmza.com` organization
+- `GITOPS_TOKEN` can read and write `ahmza.com/k8s-starter-pack`
+
+Keeping these credentials separate ensures that the package token cannot modify
+Git repositories and the GitOps token cannot publish packages.
 
 The `latest` image tag exists only to bootstrap the first Argo CD sync and for
 human inspection. Normal rollouts use the exact content digest recorded in the

.gitea/workflows/publish.yml

@@ -67,7 +67,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ci-bot
-          password: ${{ secrets.GITEATOKEN }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       # The SWS runtime image already publishes amd64 and arm64 variants and
       # this Dockerfile has no target-architecture RUN commands, so Buildx can
@@ -96,7 +96,7 @@ jobs:
         with:
           repository: ahmza.com/k8s-starter-pack
           ref: main
-          token: ${{ secrets.GITEATOKEN }}
+          token: ${{ secrets.GITOPS_TOKEN }}
           path: _gitops
 
       - name: Record the deployed image in Git