.gitea/workflows/pr-checks.yml

@@ -178,7 +178,8 @@ jobs:
       - name: Review PR diff with Claude Code
         env:
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          # Auto-provided per-run token from Gitea Actions (repo-scoped)
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           GITEA_SERVER_URL: ${{ gitea.server_url }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
           PR_NUMBER: ${{ gitea.event.pull_request.number }}

docs/DEPLOY.md

@@ -56,7 +56,7 @@ fail the E2E gate. That's the point: staging absorbs the risk.
 
 | Secret | Purpose |
 |---|---|
-| `REGISTRY_TOKEN` | push images to the registry + post PR review comments (already set) |
+| `REGISTRY_TOKEN` | push images to privaterepo.sitaru.org (already set) |
 | `CLAUDE_CODE_OAUTH_TOKEN` | Claude Code subscription auth for the PR review — generate with `claude setup-token` on your machine |
 | `PORTAINER_STAGING_WEBHOOK` | staging stack redeploy webhook URL |
 | `PORTAINER_PROD_WEBHOOK` | production stack redeploy webhook URL |
@@ -125,7 +125,8 @@ numbers, so scheduled data refreshes don't break the gate.
 
 `scripts/ci/ai_review.py` pipes the PR diff through headless Claude Code
 (`claude -p`, authenticated with the subscription OAuth token — no API
-billing), posts the structured findings as a PR comment via the Gitea API
-(reusing `REGISTRY_TOKEN`), and fails the check only when a finding is rated
+billing), posts the structured findings as a PR comment using the per-run
+token Gitea Actions provides automatically (`secrets.GITEA_TOKEN` — no setup
+needed), and fails the check only when a finding is rated
 **severe** (would break prod, leak data, or corrupt data). Minor findings are
 informational and never block a merge.