The auto-provided GITEA_TOKEN does not carry container registry write
permission on most Gitea instances, causing docker login to fail with
"unauthorized". Use a Personal Access Token supplied via the
PACKAGES_TOKEN secret, with the package namespace owner as the username.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Build the image on pushes to main, version tags and pull requests, and
push to the Gitea container registry (except on PRs) using the
auto-provided GITEA_TOKEN. Tags are derived with docker/metadata-action.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Emma Thorpe