From ca003d60d946b92b96381a8edbcaaa455a7978f5 Mon Sep 17 00:00:00 2001
From: Emi Griffith <me@emigriffith.dev>
Date: Sat, 1 Aug 2026 11:12:41 -0700
Subject: [PATCH] build-push: hoist REGISTRY_TOKEN to job env (diagnostic)

---
 .forgejo/workflows/build-push.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.forgejo/workflows/build-push.yml b/.forgejo/workflows/build-push.yml
index 7a81ba5..fa2d1b8 100644
--- a/.forgejo/workflows/build-push.yml
+++ b/.forgejo/workflows/build-push.yml
@@ -49,6 +49,7 @@ jobs:
 
     env:
       REGISTRY: https://${{ vars.REGISTRY_HOST }}
+      REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
 
     steps:
       - uses: actions/checkout@v4
@@ -110,8 +111,6 @@ jobs:
 
       - name: Log in to the Forgejo registry
         if: steps.image.outputs.changed == 'true'
-        env:
-          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           # NOT secrets.GITHUB_TOKEN -- Forgejo's per-job auto-injected token can
           # never push to the container registry (a known Forgejo limitation,