Rename GITEA_ROTATION_TOKEN secret to ROTATION_PAT (GITEA_ prefix is reserved)

.gitea/workflows/rotate-coder-token.yml

@@ -8,9 +8,11 @@ name: Rotate Coder API Token
 # it replaced.
 #
 # One-time bootstrap (see README "Auto-provisioning" section): a
-# GITEA_ROTATION_TOKEN secret holding a Gitea personal access token
-# (write:repository scope, no expiration) with permission to write this
-# repo's Actions secrets. Nothing else needs to touch this ever again.
+# ROTATION_PAT secret holding a Gitea personal access token (write:repository
+# scope, no expiration) with permission to write this repo's Actions secrets.
+# Not named GITEA_ROTATION_TOKEN because Gitea reserves the GITEA_ prefix for
+# its own automatic tokens/variables and rejects secrets with that prefix.
+# Nothing else needs to touch this ever again.
 
 on:
   schedule:
@@ -23,7 +25,7 @@ jobs:
     env:
       CODER_URL: ${{ secrets.CODER_URL }}
       CODER_SESSION_TOKEN: ${{ secrets.CODER_SESSION_TOKEN }}
-      GITEA_ROTATION_TOKEN: ${{ secrets.GITEA_ROTATION_TOKEN }}
+      ROTATION_PAT: ${{ secrets.ROTATION_PAT }}
       GITEA_API_URL: ${{ github.server_url }}/api/v1
       GITEA_REPO_PATH: ${{ github.repository }}
     steps:
@@ -56,7 +58,7 @@ jobs:
           BODY="$(jq -n --arg data "$NEW_TOKEN" '{data:$data}')"
           HTTP_STATUS="$(curl -s -o /tmp/put-secret.out -w '%{http_code}' \
             -X PUT \
-            -H "Authorization: token ${GITEA_ROTATION_TOKEN}" \
+            -H "Authorization: token ${ROTATION_PAT}" \
             -H "Content-Type: application/json" \
             -d "$BODY" \
             "${GITEA_API_URL}/repos/${GITEA_REPO_PATH}/actions/secrets/CODER_SESSION_TOKEN")"