ci: use scoped Gitea release token

.gitea/workflows/release.yml

@@ -5,14 +5,18 @@ on:
     tags:
       - "v*"
 
+permissions:
+  contents: read
+  releases: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
     env:
-      GITEA_BASE_URL: ${{ vars.GITEA_BASE_URL }}
+      GITEA_BASE_URL: ${{ github.server_url }}
       GITEA_REPOSITORY: ${{ github.repository }}
       GITEA_ALLOW_INSECURE_HTTP: ${{ vars.GITEA_ALLOW_INSECURE_HTTP }}
-      GITEA_TOKEN: ${{ secrets.RELEASE_GITEA_TOKEN }}
+      GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
       RELEASE_PRIVATE_KEY_B64: ${{ secrets.RELEASE_PRIVATE_KEY_B64 }}
       NODE_OPTIONS: --max-old-space-size=8192
     steps:
@@ -44,7 +48,7 @@ jobs:
           esac
           [[ "$repository" =~ ^[^/[:space:]]+/[^/[:space:]]+$ ]] \
             || { printf 'invalid GITEA_REPOSITORY\n' >&2; exit 1; }
-          [[ -n "${GITEA_TOKEN:-}" ]] || { printf 'missing RELEASE_GITEA_TOKEN secret\n' >&2; exit 1; }
+          [[ -n "${GITEA_TOKEN:-}" ]] || { printf 'missing built-in GITEA_TOKEN\n' >&2; exit 1; }
           [[ -n "${RELEASE_PRIVATE_KEY_B64:-}" ]] \
             || { printf 'missing RELEASE_PRIVATE_KEY_B64 secret\n' >&2; exit 1; }