refactor(workflows): rename secrets MOKOGITEA_TOKEN/GITHUB_TOKEN, use x-access-token [skip bump]

.mokogitea/workflows/auto-bump.yml

@@ -37,7 +37,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.GA_TOKEN }}
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
           fetch-depth: 1
 
       - name: Setup moko-platform tools
@@ -49,7 +49,7 @@ jobs:
             echo "MOKO_CLI=/opt/moko-platform/cli" >> "$GITHUB_ENV"
           else
             git clone --depth 1 --branch main --quiet \
-              "https://x-access-token:${{ secrets.GA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/moko-platform.git" \
+              "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/moko-platform.git" \
               /tmp/moko-platform-api
             cd /tmp/moko-platform-api && composer install --no-dev --no-interaction --quiet
             echo "MOKO_CLI=/tmp/moko-platform-api/cli" >> "$GITHUB_ENV"
@@ -77,7 +77,7 @@ jobs:
 
           git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
           git config --local user.name "gitea-actions[bot]"
-          git remote set-url origin "https://jmiller:${{ secrets.GA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
           git add -A
           git commit -m "chore(version): auto-bump patch ${VERSION} [skip ci]" \
             --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>"

.mokogitea/workflows/auto-release.yml

@@ -63,12 +63,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.GA_TOKEN }}
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
           fetch-depth: 1
 
       - name: Setup moko-platform tools
         env:
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN }}
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
         run: |
           if ! command -v composer &> /dev/null; then
@@ -85,7 +85,7 @@ jobs:
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           php /tmp/moko-platform-api/cli/release_promote.php \
             --from auto --to release-candidate \
-            --token "${{ secrets.GA_TOKEN }}" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
             --api-base "${API_BASE}" \
             --branch "${{ github.event.pull_request.head.ref || 'dev' }}"
 
@@ -95,7 +95,7 @@ jobs:
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           php /tmp/moko-platform-api/cli/release_cascade.php \
             --stability release-candidate \
-            --token "${{ secrets.GA_TOKEN }}" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
             --api-base "${API_BASE}"
 
       - name: Summary
@@ -116,14 +116,20 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.GA_TOKEN }}
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
           fetch-depth: 0
 
+      - name: Configure git for bot pushes
+        run: |
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+
       - name: Setup moko-platform tools
         env:
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN }}
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN }}"}}'
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GITHUB_TOKEN }}"}}'
         run: |
           # Ensure PHP + Composer are available
           if ! command -v composer &> /dev/null; then
@@ -169,7 +175,7 @@ jobs:
         if: steps.version.outputs.skip != 'true'
         run: |
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          RC_JSON=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
+          RC_JSON=$(curl -sf -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \
             "${API_BASE}/releases/tags/release-candidate" 2>/dev/null || echo "{}")
           RC_ID=$(echo "$RC_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('id',''))" 2>/dev/null || true)
 
@@ -285,10 +291,6 @@ jobs:
             exit 0
           fi
           VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "gitea-actions[bot]"
-          # Set push URL with token for branch-protected repos
-          git remote set-url origin "https://jmiller:${{ secrets.GA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
           git add -A
           git commit -m "chore(release): build ${VERSION} [skip ci]" \
             --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>"
@@ -320,7 +322,7 @@ jobs:
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           php /tmp/moko-platform-api/cli/release_promote.php \
             --from release-candidate --to stable \
-            --token "${{ secrets.GA_TOKEN }}" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
             --api-base "${API_BASE}" \
             --path . --branch main
           echo "Promoted RC → stable (${VERSION})" >> $GITHUB_STEP_SUMMARY
@@ -336,7 +338,7 @@ jobs:
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           php /tmp/moko-platform-api/cli/release_create.php \
             --path . --version "$VERSION" --tag "$RELEASE_TAG" \
-            --token "${{ secrets.GA_TOKEN }}" --api-base "$API_BASE" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
             --repo "${GITEA_REPO}" --branch main
           echo "Release created: ${VERSION}" >> $GITHUB_STEP_SUMMARY
 
@@ -352,7 +354,7 @@ jobs:
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           php /tmp/moko-platform-api/cli/release_package.php \
             --path . --version "$VERSION" --tag "$RELEASE_TAG" \
-            --token "${{ secrets.GA_TOKEN }}" --api-base "$API_BASE" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
             --repo "${GITEA_REPO}" --output /tmp || true
 
       # -- STEP 5: Write update stream (after build so SHA-256 is available) -----
@@ -363,9 +365,9 @@ jobs:
           SHA256="${{ steps.package.outputs.sha256_zip }}"
 
           # Fetch latest updates.xml from main so preserve logic has all channels
-          GA_TOKEN="${{ secrets.GA_TOKEN }}"
+          GITEA_TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
           API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
-          curl -sf -H "Authorization: token ${GA_TOKEN}" \
+          curl -sf -H "Authorization: token ${GITEA_TOKEN}" \
             "${API}/contents/updates.xml?ref=main" 2>/dev/null | \
             python3 -c "import sys,json,base64; print(base64.b64decode(json.load(sys.stdin)['content']).decode())" \
             > updates.xml 2>/dev/null || true
@@ -380,9 +382,6 @@ jobs:
 
           # Commit updates.xml if changed
           if ! git diff --quiet updates.xml 2>/dev/null; then
-            git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-            git config --local user.name "gitea-actions[bot]"
-            git remote set-url origin "https://jmiller:${{ secrets.GA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
             git add updates.xml
             git commit -m "chore: update stable channel ${VERSION} [skip ci]" \
               --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>"
@@ -398,7 +397,7 @@ jobs:
           RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
           php /tmp/moko-platform-api/cli/release_body_update.php \
             --path . --version "${VERSION}" --tag "${RELEASE_TAG}" \
-            --token "${{ secrets.GA_TOKEN }}" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
             --gitea-url "${GITEA_URL}" --org "${GITEA_ORG}" --repo "${GITEA_REPO}" \
             2>&1 || true
           echo "Release body updated" >> $GITHUB_STEP_SUMMARY
@@ -407,7 +406,7 @@ jobs:
       - name: "Step 9: Mirror release to GitHub"
         if: >-
           steps.version.outputs.skip != 'true' &&
-          secrets.GH_TOKEN != ''
+          secrets.GITHUB_TOKEN != ''
         continue-on-error: true
         run: |
           VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
@@ -416,8 +415,8 @@ jobs:
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           php /tmp/moko-platform-api/cli/release_mirror.php \
             --version "$VERSION" --tag "$RELEASE_TAG" \
-            --token "${{ secrets.GA_TOKEN }}" --api-base "$API_BASE" \
-            --gh-token "${{ secrets.GH_TOKEN }}" --gh-repo "$GH_REPO" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
+            --gh-token "${{ secrets.GITHUB_TOKEN }}" --gh-repo "$GH_REPO" \
             --branch main 2>&1 || true
           echo "GitHub mirror updated" >> $GITHUB_STEP_SUMMARY
 
@@ -425,14 +424,14 @@ jobs:
       - name: "Step 10: Push main to GitHub mirror"
         if: >-
           steps.version.outputs.skip != 'true' &&
-          secrets.GH_TOKEN != ''
+          secrets.GITHUB_TOKEN != ''
         continue-on-error: true
         run: |
           GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
           GH_ORG=$(echo "$GH_REPO" | cut -d/ -f1)
           GH_NAME=$(echo "$GH_REPO" | cut -d/ -f2)
-          git remote add github "https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git" 2>/dev/null || \
-            git remote set-url github "https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git"
+          git remote add github "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git" 2>/dev/null || \
+            git remote set-url github "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git"
           git fetch origin main --depth=1
           git push github origin/main:refs/heads/main --force 2>/dev/null \
             && echo "main branch pushed to GitHub mirror" \
@@ -448,7 +447,7 @@ jobs:
           php /tmp/moko-platform-api/cli/release_cascade.php \
             --stability stable \
             --version "${VERSION}" \
-            --token "${{ secrets.GA_TOKEN }}" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
             --api-base "${API_BASE}" 2>/dev/null || true
 
       - name: "Step 11: Delete and recreate dev branch from main"
@@ -456,7 +455,7 @@ jobs:
         continue-on-error: true
         run: |
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          TOKEN="${{ secrets.GA_TOKEN }}"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
 
           # Delete dev branch
           curl -sf -X DELETE -H "Authorization: token ${TOKEN}" \
@@ -475,7 +474,7 @@ jobs:
         continue-on-error: true
         run: |
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          TOKEN="${{ secrets.GA_TOKEN }}"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
           VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
           BRANCH_NAME="version/${VERSION}"
           MAIN_SHA=$(git rev-parse HEAD)
@@ -497,7 +496,7 @@ jobs:
         run: |
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           php /tmp/moko-platform-api/cli/version_reset_dev.php \
-            --token "${{ secrets.GA_TOKEN }}" --api-base "${API_BASE}" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "${API_BASE}" \
             --branch dev --path . 2>&1 || true
 
       # -- Summary --------------------------------------------------------------

.mokogitea/workflows/cascade-dev.yml

@@ -8,21 +8,21 @@
 # REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/moko-platform
 # PATH: /templates/workflows/cascade-dev.yml.template
 # VERSION: 02.00.00
-# BRIEF: Forward-merge main -> all open branches after every push to main
+# BRIEF: Forward-merge main → all open branches after every push to main
 #
 # +========================================================================+
-# |                CASCADE MAIN -> ALL BRANCHES                             |
+# |                CASCADE MAIN → ALL BRANCHES                             |
 # +========================================================================+
 # |                                                                        |
 # |  Triggers on every push to main (PR merges, bot commits, etc.)         |
 # |                                                                        |
 # |  1. List all branches matching: dev, rc/*, beta/*, alpha/*             |
-# |  2. For each: create PR (main -> branch), auto-merge if clean           |
+# |  2. For each: create PR (main → branch), auto-merge if clean           |
 # |  3. On conflict: leave PR open for manual resolution                   |
 # |                                                                        |
 # +========================================================================+
 
-name: "Universal: Cascade Main -> Dev"
+name: "Universal: Cascade Main → Dev"
 
 on:
   push:
@@ -42,7 +42,7 @@ permissions:
 
 jobs:
   cascade:
-    name: Cascade main -> branches
+    name: Cascade main → branches
     runs-on: ubuntu-latest
     if: >-
       !contains(github.event.head_commit.message, '[skip ci]') &&
@@ -52,7 +52,7 @@ jobs:
       - name: Discover target branches
         id: branches
         env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
         run: |
           API="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
 
@@ -61,7 +61,7 @@ jobs:
           ALL_BRANCHES=""
           while true; do
             BATCH=$(curl -sS \
-              -H "Authorization: token ${GA_TOKEN}" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
               "${API}/branches?page=${PAGE}&limit=50" \
               | jq -r '.[].name // empty')
             [ -z "$BATCH" ] && break
@@ -83,17 +83,17 @@ jobs:
 
           if [ -z "$TARGETS" ]; then
             echo "targets=" >> "$GITHUB_OUTPUT"
-            echo "  No cascade target branches found"
+            echo "ℹ️  No cascade target branches found"
           else
             echo "targets=$TARGETS" >> "$GITHUB_OUTPUT"
             COUNT=$(echo "$TARGETS" | wc -w)
-            echo " Found ${COUNT} target branch(es): ${TARGETS}"
+            echo "📋 Found ${COUNT} target branch(es): ${TARGETS}"
           fi
 
       - name: Cascade to all target branches
         if: steps.branches.outputs.targets != ''
         env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
         run: |
           API="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           SHORT_SHA="${GITHUB_SHA:0:7}"
@@ -106,27 +106,27 @@ jobs:
 
           for BRANCH in $TARGETS; do
             echo ""
-            echo " main -> ${BRANCH} "
+            echo "═══ main → ${BRANCH} ═══"
 
             # Check if branch is already up to date
             ENCODED_BRANCH=$(echo "$BRANCH" | sed 's|/|%2F|g')
             RESPONSE=$(curl -sS \
-              -H "Authorization: token ${GA_TOKEN}" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
               "${API}/compare/${ENCODED_BRANCH}...main")
 
             AHEAD=$(echo "$RESPONSE" | jq '.total_commits // 0')
 
             if [ "$AHEAD" -eq 0 ]; then
-              echo "   Already up to date"
+              echo "  ✅ Already up to date"
               SKIPPED=$((SKIPPED + 1))
               continue
             fi
 
-            echo "    main is ${AHEAD} commit(s) ahead"
+            echo "  ℹ️  main is ${AHEAD} commit(s) ahead"
 
             # Check for existing cascade PR
             EXISTING=$(curl -sS \
-              -H "Authorization: token ${GA_TOKEN}" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
               "${API}/pulls?state=open&head=${GITEA_ORG}:main&base=${ENCODED_BRANCH}&limit=1")
 
             EXISTING_COUNT=$(echo "$EXISTING" | jq 'length')
@@ -134,16 +134,16 @@ jobs:
 
             if [ "$EXISTING_COUNT" -gt 0 ]; then
               PR_NUMBER=$(echo "$EXISTING" | jq -r '.[0].number')
-              echo "    Reusing existing PR #${PR_NUMBER}"
+              echo "  ℹ️  Reusing existing PR #${PR_NUMBER}"
             else
               # Create cascade PR
               PR_RESPONSE=$(curl -sS -w "\n%{http_code}" \
                 -X POST \
-                -H "Authorization: token ${GA_TOKEN}" \
+                -H "Authorization: token ${GITEA_TOKEN}" \
                 -H "Content-Type: application/json" \
                 -d "{
-                  \"title\": \"chore: cascade main -> ${BRANCH} (${SHORT_SHA}) [skip ci]\",
-                  \"body\": \"## Automatic cascade\\n\\nForward-merging \`main\` (${SHORT_SHA}) into \`${BRANCH}\`.\\n\\nIf conflicts exist, resolve manually and merge.\\n\\n> Auto-created by **Cascade Main -> Dev**.\",
+                  \"title\": \"chore: cascade main → ${BRANCH} (${SHORT_SHA}) [skip ci]\",
+                  \"body\": \"## Automatic cascade\\n\\nForward-merging \`main\` (${SHORT_SHA}) into \`${BRANCH}\`.\\n\\nIf conflicts exist, resolve manually and merge.\\n\\n> Auto-created by **Cascade Main → Dev**.\",
                   \"head\": \"main\",
                   \"base\": \"${BRANCH}\"
                 }" \
@@ -155,34 +155,34 @@ jobs:
 
               if [ "$HTTP_CODE" != "201" ] || [ -z "$PR_NUMBER" ]; then
                 MSG=$(echo "$BODY" | jq -r '.message // .' 2>/dev/null | head -1)
-                echo "   Failed to create PR (HTTP ${HTTP_CODE}): ${MSG}"
+                echo "  ❌ Failed to create PR (HTTP ${HTTP_CODE}): ${MSG}"
                 FAILED=$((FAILED + 1))
                 continue
               fi
 
-              echo "   Created PR #${PR_NUMBER}"
+              echo "  ✅ Created PR #${PR_NUMBER}"
             fi
 
             # Try auto-merge
             PR_DATA=$(curl -sS \
-              -H "Authorization: token ${GA_TOKEN}" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
               "${API}/pulls/${PR_NUMBER}")
 
             MERGEABLE=$(echo "$PR_DATA" | jq -r '.mergeable // false')
 
             if [ "$MERGEABLE" != "true" ]; then
-              echo "    Conflicts -- PR #${PR_NUMBER} left open"
+              echo "  ⚠️  Conflicts — PR #${PR_NUMBER} left open"
               CONFLICTS=$((CONFLICTS + 1))
               continue
             fi
 
             MERGE_RESPONSE=$(curl -sS -w "\n%{http_code}" \
               -X POST \
-              -H "Authorization: token ${GA_TOKEN}" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
               -H "Content-Type: application/json" \
               -d "{
                 \"Do\": \"merge\",
-                \"merge_message_field\": \"chore: cascade main -> ${BRANCH} [skip ci]\",
+                \"merge_message_field\": \"chore: cascade main → ${BRANCH} [skip ci]\",
                 \"delete_branch_after_merge\": false
               }" \
               "${API}/pulls/${PR_NUMBER}/merge")
@@ -190,23 +190,23 @@ jobs:
             MERGE_HTTP=$(echo "$MERGE_RESPONSE" | tail -1)
 
             if [ "$MERGE_HTTP" = "200" ] || [ "$MERGE_HTTP" = "204" ]; then
-              echo "   Merged -- ${BRANCH} is in sync"
+              echo "  ✅ Merged — ${BRANCH} is in sync"
               SUCCESS=$((SUCCESS + 1))
             else
               MERGE_BODY=$(echo "$MERGE_RESPONSE" | sed '$d')
-              echo "    Merge failed (HTTP ${MERGE_HTTP}) -- PR #${PR_NUMBER} left open"
+              echo "  ⚠️  Merge failed (HTTP ${MERGE_HTTP}) — PR #${PR_NUMBER} left open"
               CONFLICTS=$((CONFLICTS + 1))
             fi
           done
 
           # Summary
           echo ""
-          echo ""
-          echo "   Merged:    ${SUCCESS}"
-          echo "    Conflicts: ${CONFLICTS}"
-          echo "    Up to date: ${SKIPPED}"
-          echo "   Failed:    ${FAILED}"
-          echo ""
+          echo "════════════════════════════════════════"
+          echo "  ✅ Merged:    ${SUCCESS}"
+          echo "  ⚠️  Conflicts: ${CONFLICTS}"
+          echo "  ⏭️  Up to date: ${SKIPPED}"
+          echo "  ❌ Failed:    ${FAILED}"
+          echo "════════════════════════════════════════"
 
           if [ "$FAILED" -gt 0 ]; then
             exit 1

.mokogitea/workflows/pre-release.yml

@@ -50,11 +50,11 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.GA_TOKEN }}
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
 
       - name: Setup moko-platform tools
         env:
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN }}
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
         run: |
           if ! command -v composer &> /dev/null; then
@@ -104,7 +104,7 @@ jobs:
           # Commit version bump
           git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
           git config --local user.name "gitea-actions[bot]"
-          git remote set-url origin "https://jmiller:${{ secrets.GA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
           git add -A
           git diff --cached --quiet || {
             git commit -m "chore(version): pre-release bump to ${VERSION} [skip ci]"
@@ -139,7 +139,7 @@ jobs:
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           php ${MOKO_CLI}/release_create.php \
             --path . --version "$VERSION" --tag "$TAG" \
-            --token "${{ secrets.GA_TOKEN }}" --api-base "$API_BASE" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
             --repo "${GITEA_REPO}" --branch dev --prerelease
 
       - name: Build package and upload
@@ -150,7 +150,7 @@ jobs:
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           php ${MOKO_CLI}/release_package.php \
             --path . --version "$VERSION" --tag "$TAG" \
-            --token "${{ secrets.GA_TOKEN }}" --api-base "$API_BASE" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
             --repo "${GITEA_REPO}" --output /tmp || true
 
       - name: Update updates.xml
@@ -207,7 +207,7 @@ jobs:
         continue-on-error: true
         run: |
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          TOKEN="${{ secrets.GA_TOKEN }}"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
 
           php ${MOKO_CLI}/release_cascade.php \
             --stability "${{ steps.meta.outputs.stability }}" \

.mokogitea/workflows/update-server.yml

@@ -73,14 +73,14 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
-          token: ${{ secrets.GA_TOKEN }}
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
           fetch-depth: 0
 
       - name: Setup moko-platform tools
         env:
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN }}
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
-          COMPOSER_AUTH: '{"http-basic":{"git.mokoconsulting.tech":{"username":"token","password":"${{ secrets.GA_TOKEN }}"}}}'
+          COMPOSER_AUTH: '{"http-basic":{"git.mokoconsulting.tech":{"username":"token","password":"${{ secrets.MOKOGITEA_TOKEN }}"}}}'
         run: |
           if ! command -v composer &> /dev/null; then
             sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
@@ -106,9 +106,12 @@ jobs:
         run: |
           BRANCH="${{ github.ref_name }}"
 
-          # Auto-bump patch version
+          # Configure git for bot pushes
           git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
           git config --local user.name "gitea-actions[bot]"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+
+          # Auto-bump patch version
           php ${MOKO_CLI}/version_bump.php --path . 2>/dev/null || true
 
           VERSION=$(php ${MOKO_CLI}/version_read.php --path . 2>/dev/null || echo "0.0.0")
@@ -169,13 +172,13 @@ jobs:
           # Create or update Gitea release
           php ${MOKO_CLI}/release_create.php \
             --path . --version "$VERSION" --tag "$TAG" \
-            --token "${{ secrets.GA_TOKEN }}" --api-base "$API_BASE" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
             --repo "${GITEA_REPO}" --branch "${{ github.ref_name }}" --prerelease
 
           # Build package and upload
           php ${MOKO_CLI}/release_package.php \
             --path . --version "$VERSION" --tag "$TAG" \
-            --token "${{ secrets.GA_TOKEN }}" --api-base "$API_BASE" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
             --repo "${GITEA_REPO}" --output /tmp || true
 
       - name: Update updates.xml
@@ -199,8 +202,6 @@ jobs:
             ${SHA_FLAG}
 
           # Commit and push updates.xml
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "gitea-actions[bot]"
           git add updates.xml
           git diff --cached --quiet || {
             git commit -m "chore: update ${STABILITY} channel ${VERSION} [skip ci]"
@@ -211,9 +212,9 @@ jobs:
         if: github.ref_name != 'main' && steps.platform.outputs.platform == 'joomla'
         run: |
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          GA_TOKEN="${{ secrets.GA_TOKEN }}"
+          GITEA_TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
 
-          FILE_SHA=$(curl -sf -H "Authorization: token ${GA_TOKEN}" \
+          FILE_SHA=$(curl -sf -H "Authorization: token ${GITEA_TOKEN}" \
             "${API_BASE}/contents/updates.xml?ref=main" | python3 -c "import sys,json; print(json.load(sys.stdin).get('sha',''))" 2>/dev/null || true)
 
           if [ -n "$FILE_SHA" ] && [ -f "updates.xml" ]; then
@@ -231,7 +232,7 @@ jobs:
               '${API_BASE}/contents/updates.xml',
               data=payload, method='PUT',
               headers={
-                  'Authorization': 'token ${GA_TOKEN}',
+                  'Authorization': 'token ${GITEA_TOKEN}',
                   'Content-Type': 'application/json'
               })
           try:
@@ -257,7 +258,7 @@ jobs:
           ACTOR="${{ github.actor }}"
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
 
-          PERMISSION=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
+          PERMISSION=$(curl -sf -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \
             "${API_BASE}/collaborators/${ACTOR}/permission" 2>/dev/null | \
             python3 -c "import sys,json; print(json.load(sys.stdin).get('permission','read'))" 2>/dev/null || echo "read")
           case "$PERMISSION" in