The note said Codeberg needs the secret but not what happens without it,
so the failure mode had to be inferred from a red job. Record it: build
and packaging still succeed, the upload step fails on authentication and
takes the job with it, and the release is published with no assets.
Not "the upload step is skipped", which is what the comment in
.forgejo/workflows/release.yml claims. That step is guarded only by
`if: github.event_name == 'release'` — there is no token check and no
continue-on-error, so an absent or unscoped token makes it fail rather
than skip. Skipping is the workflow_dispatch path. The workflow comment
is still wrong and is left for a separate change.
Also name why GitHub needs no setup: softprops/action-gh-release falls
back to the built-in GITHUB_TOKEN and the workflow grants contents:write.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
mixeme
0cf44e1dfa