Use registry token secret for image push

.gitea/workflows/ci-cd.yml

@@ -61,14 +61,14 @@ jobs:
       - name: Login to registry
         env:
           REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
-          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           set -eu
-          if [ -z "${REGISTRY_USERNAME:-}" ] || [ -z "${REGISTRY_PASSWORD:-}" ]; then
-            echo "REGISTRY_USERNAME and REGISTRY_PASSWORD secrets are required."
+          if [ -z "${REGISTRY_USERNAME:-}" ] || [ -z "${REGISTRY_TOKEN:-}" ]; then
+            echo "REGISTRY_USERNAME and REGISTRY_TOKEN secrets are required."
             exit 1
           fi
-          printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY_URL" --username "$REGISTRY_USERNAME" --password-stdin
+          printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY_URL" --username "$REGISTRY_USERNAME" --password-stdin
 
       - name: Build Docker image
         run: |

deploy/README.md

@@ -50,7 +50,7 @@ The workflow at `.gitea/workflows/ci-cd.yml` expects these repository secrets:
 ```sh
 REGISTRY_URL=gitea.blyzer.com.br
 REGISTRY_USERNAME=...
-REGISTRY_PASSWORD=...
+REGISTRY_TOKEN=...
 IMAGE_REPOSITORY=blyzer/production-order-tiny
 PORTAINER_WEBHOOK_URL=https://... # optional but recommended
 ```