fix: replace crane with regctl; use --auth-basic to skip Gitea token exchange

.gitea/workflows/docker.yml

@@ -71,26 +71,31 @@ jobs:
           platforms: linux/amd64,linux/arm64
           provenance: false
 
-      - name: Install crane
+      - name: Install regctl
         if: github.event_name != 'pull_request'
         run: |
-          CRANE_VER=$(curl -s https://api.github.com/repos/google/go-containerregistry/releases/latest \
-            | grep '"tag_name"' | cut -d'"' -f4)
-          curl -sL "https://github.com/google/go-containerregistry/releases/download/${CRANE_VER}/go-containerregistry_Linux_x86_64.tar.gz" \
-            | tar xz -C /usr/local/bin crane
+          curl -sL "https://github.com/regclient/regclient/releases/latest/download/regctl-linux-amd64" \
+            -o /usr/local/bin/regctl
+          chmod +x /usr/local/bin/regctl
+
+      # regctl supports OCI archives and can be forced to use HTTP Basic auth,
+      # bypassing Gitea's broken Bearer token endpoint entirely.
+      - name: Configure registry auth
+        if: github.event_name != 'pull_request'
+        run: |
+          regctl registry login ${{ env.REGISTRY }} \
+            -u ${{ secrets.REGISTRY_USER }} \
+            -p ${{ secrets.REGISTRY_PASSWORD }}
+          regctl registry set ${{ env.REGISTRY }} --auth-basic
 
-      # Push with crane which handles Gitea's registry auth correctly.
       - name: Push standard image
         if: github.event_name != 'pull_request'
         env:
           TAGS: ${{ steps.meta.outputs.tags }}
         run: |
-          crane auth login ${{ env.REGISTRY }} \
-            -u ${{ secrets.REGISTRY_USER }} \
-            -p ${{ secrets.REGISTRY_PASSWORD }}
           echo "$TAGS" | while IFS= read -r tag; do
             [ -z "$tag" ] && continue
-            crane push /tmp/lmr-standard.tar "$tag"
+            regctl image copy "ociarchive:/tmp/lmr-standard.tar" "$tag"
           done
 
       - name: Push bundled image
@@ -100,5 +105,5 @@ jobs:
         run: |
           echo "$TAGS" | while IFS= read -r tag; do
             [ -z "$tag" ] && continue
-            crane push /tmp/lmr-bundled.tar "$tag"
+            regctl image copy "ociarchive:/tmp/lmr-bundled.tar" "$tag"
           done