From 8c260feb78395fcec4bb99699f323c30319ead20 Mon Sep 17 00:00:00 2001
From: "Timur Kh." <timka@timka.su>
Date: Thu, 22 Oct 2026 19:08:07 +0300
Subject: [PATCH] cicd fixes and desktop fix

---
 .gitea/workflows/android-release.yml |  2 +-
 .gitea/workflows/docker.yml          | 13 ++++++++++++-
 README.md                            |  2 +-
 desktop/kadence_desktop/tray.py      |  1 -
 4 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/android-release.yml b/.gitea/workflows/android-release.yml
index 2f79e04..6120bf4 100644
--- a/.gitea/workflows/android-release.yml
+++ b/.gitea/workflows/android-release.yml
@@ -96,7 +96,7 @@ jobs:
             fi
           fi
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v3
         with:
           name: kadence-release-apk
           path: android/app/build/outputs/apk/release/app-release.apk
diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
index ea8c877..a1291be 100644
--- a/.gitea/workflows/docker.yml
+++ b/.gitea/workflows/docker.yml
@@ -15,6 +15,14 @@ on:
     branches: [master]
     tags: ["v*"]
 
+# The built-in job token is enough to push to this instance's own registry; a
+# REGISTRY_TOKEN secret is only needed when it is not (an older Gitea, or a
+# restricted default permission mode). Ask for packages: write explicitly so the
+# token is not silently read-only on instances that default to restricted.
+permissions:
+  contents: read
+  packages: write
+
 env:
   REGISTRY: git.timka.su
   IMAGE: git.timka.su/timka123/kadence
@@ -35,7 +43,10 @@ jobs:
           # so a missing REGISTRY_USER secret does not fail the job with docker's
           # unhelpful "username is empty".
           REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.repository_owner }}
-          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          # Gitea gives every job a built-in token (secrets.GITEA_TOKEN). Prefer
+          # an explicit secret, but fall back to that token so a fresh repository
+          # publishes without anyone having to mint one by hand.
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || secrets.GITEA_TOKEN }}
         run: |
           if [ -z "$REGISTRY_USER" ] || [ -z "$REGISTRY_TOKEN" ]; then
             echo "::error::Container registry credentials are missing. Set REGISTRY_TOKEN (a token with package:write) under Settings → Actions → Secrets; REGISTRY_USER is optional and defaults to the repository owner."
diff --git a/README.md b/README.md
index 99d24e5..42b8ad0 100644
--- a/README.md
+++ b/README.md
@@ -299,7 +299,7 @@ Secrets, all under *Repository → Settings → Actions → Secrets*:
 
 | Secret | For |
 | --- | --- |
-| `REGISTRY_TOKEN` | pushing to the Gitea registry (a token with `package:write`); `REGISTRY_USER` is optional and defaults to the repository owner |
+| `REGISTRY_TOKEN` | only when the built-in `GITEA_TOKEN` cannot push to the Gitea registry (older Gitea, or restricted token permissions); `package:write` is needed. `REGISTRY_USER` is optional and defaults to the repository owner |
 | `KADENCE_KEYSTORE_BASE64` | `base64 -w0 your.keystore` |
 | `KADENCE_KEYSTORE_PASSWORD`, `KADENCE_KEY_ALIAS`, `KADENCE_KEY_PASSWORD` | the key inside it |
 
diff --git a/desktop/kadence_desktop/tray.py b/desktop/kadence_desktop/tray.py
index 9950783..52253c7 100644
--- a/desktop/kadence_desktop/tray.py
+++ b/desktop/kadence_desktop/tray.py
@@ -84,7 +84,6 @@ class Tray(QObject):
         controller.connectionChanged.connect(self.refresh)
         controller.blockerChanged.connect(self.refresh)
         controller.miniChanged.connect(self.refresh)
-        controller.settingsChanged.connect(self.refresh)
         controller.configChanged.connect(self.refresh)
         self.refresh()