security(runner): remove plaintext token fallbacks, untrack .env, and enforce secret-only authentication

.gitea/workflows/build-runner.yml

@@ -27,8 +27,8 @@ jobs:
       - name: Log in to Gitea Container Registry
         run: |
           REGISTRY="gitea.eibl.tech"
-          USER="${{ secrets.PACKAGESUSER || secrets.GITEAUSER || secrets.packagesuser || 'me0nline' }}"
-          PASS="${{ secrets.GITEATOKEN || secrets.PACKAGESTOKEN || secrets.packagestoken || 'f64c72025024b0628479b889d871eb764d812951' }}"
+          USER="${{ secrets.GITEAUSER || secrets.PACKAGESUSER || github.actor }}"
+          PASS="${{ secrets.GITEATOKEN || secrets.PACKAGESTOKEN || secrets.TAG_TOKEN || github.token }}"
           echo "Logging in to ${REGISTRY} as ${USER}..."
           echo "${PASS}" | docker login "${REGISTRY}" -u "${USER}" --password-stdin
 

.gitignore

@@ -29,6 +29,9 @@ server_config.json
 client_config.json
 test_*.json
 test_*.db
+.env
+*.env
+runner/.env
 
 # IDE & OS files
 .vscode/

runner/.env

@@ -1,8 +0,0 @@
-# Gitea Instance URL
-GITEA_INSTANCE_URL=https://gitea.eibl.tech
-
-# Gitea Runner Registration Token
-GITEA_RUNNER_REGISTRATION_TOKEN=MGynktVmt75MWfqRjahWLKsLKvOlrXDQZH5Wsn2p
-
-# Runner Configuration
-GITEA_RUNNER_NAME=logar-build-runner

runner/docker-compose.yml

@@ -9,7 +9,7 @@ services:
       - .env
     environment:
       - GITEA_INSTANCE_URL=${GITEA_INSTANCE_URL:-https://gitea.eibl.tech}
-      - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN:-MGynktVmt75MWfqRjahWLKsLKvOlrXDQZH5Wsn2p}
+      - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN}
       - GITEA_RUNNER_NAME=${GITEA_RUNNER_NAME:-logar-build-runner}
       - GITEA_RUNNER_LABELS=logar:docker://gitea.eibl.tech/me0nline/logar-runner:latest
     volumes: