The auto-injected secrets.GITEA_TOKEN doesn't work for pushing to Gitea's container registry regardless of the workflow's own permissions: block -- a known Gitea limitation, not a config mistake (go-gitea/gitea#23642). Switch to a manually-configured CONTAINER_REGISTRY_PASSWORD secret (a personal access token with write:package scope) instead. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>