Read the release token from RELEASE_TOKEN

The publish step set GITEA_TOKEN from the org-level API_TOKEN secret, but
the Actions runner injects its own GITEA_TOKEN into every step and that
value overrides a step-level env: entry of the same name. The org secret
was silently ignored and the job failed.

Pass the secret as RELEASE_TOKEN instead, which the runner does not
reserve, and read that name in release.py. --token-env makes the source
configurable, so the runner-provided GITEA_TOKEN can still be used
deliberately by passing --token-env GITEA_TOKEN.

tools/release.py

@@ -10,7 +10,9 @@ Stdlib only, so it runs on any runner image without a pip install step.
 Usage:
     tools/release.py --api <repo-api-url> --tag v1.0.0 --artifact dist/x.plugin
 
-The token is read from GITEA_TOKEN (or GITHUB_TOKEN as a fallback).
+The token is read from RELEASE_TOKEN by default; override with --token-env.
+Deliberately not GITEA_TOKEN: the Actions runner injects its own value for
+that name into every step, which overrides a step-level `env:` entry.
 """
 from __future__ import annotations
 
@@ -147,11 +149,19 @@ def main(argv: Optional[list] = None) -> int:
     parser.add_argument("--artifact", required=True, help="file to attach")
     parser.add_argument("--commitish", default="", help="target commit for a new tag")
     parser.add_argument("--asset-name", default="", help="attachment name; defaults to the file name")
+    parser.add_argument(
+        "--token-env",
+        default="RELEASE_TOKEN",
+        help="environment variable holding the API token (default: RELEASE_TOKEN)",
+    )
     args = parser.parse_args(argv)
 
-    token = os.environ.get("GITEA_TOKEN") or os.environ.get("GITHUB_TOKEN") or ""
+    # Read from an explicitly named variable rather than GITEA_TOKEN: the
+    # Actions runner injects its own GITEA_TOKEN into every step, which
+    # silently wins over a step-level `env:` of the same name.
+    token = os.environ.get(args.token_env, "")
     if not token:
-        fail("GITEA_TOKEN is not set")
+        fail(f"{args.token_env} is not set")
 
     artifact = Path(args.artifact)
     if not artifact.is_file() or artifact.stat().st_size == 0: