ci: drop env token; rely on permissions: releases: write for release upload

.gitea/workflows/ci.yml

@@ -159,22 +159,21 @@ jobs:
           path: dist-deb/*.deb
 
       - name: Create Gitea release and upload assets
-        env:
-          GITEA_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           api="${{ github.server_url }}/api/v1"
           repo="${{ github.repository }}"
           tag="${{ github.ref_name }}"
           payload="{\"tag_name\":\"$tag\",\"name\":\"$tag\"}"
+          token="${{ secrets.GITEA_TOKEN }}"
 
           out=$(curl -sS -X POST "$api/repos/$repo/releases" \
-            -H "Authorization: token $GITEA_TOKEN" \
+            -H "Authorization: token $token" \
             -H "Content-Type: application/json" \
             -d "$payload" || true)
           if ! printf '%s' "$out" | grep -q '"id"'; then
             out=$(curl -sS "$api/repos/$repo/releases/tags/$tag" \
-              -H "Authorization: token $GITEA_TOKEN")
+              -H "Authorization: token $token")
           fi
           rid=$(printf '%s' "$out" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
           [ -n "$rid" ] || { echo "release id not found" >&2; exit 1; }
@@ -182,7 +181,7 @@ jobs:
           for f in dist/*.whl dist-deb/*.deb; do
             [ -e "$f" ] || continue
             curl -fsS -X POST "$api/repos/$repo/releases/$rid/assets?name=$(basename "$f")" \
-              -H "Authorization: token $GITEA_TOKEN" \
+              -H "Authorization: token $token" \
               --data-binary @"$f"
             echo "Uploaded $(basename "$f")"
           done