From 252edbb9680a5e82350093b059c5a52edbacb740 Mon Sep 17 00:00:00 2001
From: Alexandru Macocian <amacocian@yahoo.com>
Date: Tue, 5 May 2026 14:01:38 +0200
Subject: [PATCH] Use absolute URL with PAT for sops-decrypt; declare
 RUNNER_REPO_PAT secret

---
 .gitea/workflows/deploy-stack.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.gitea/workflows/deploy-stack.yml b/.gitea/workflows/deploy-stack.yml
index 377b387..cc3668e 100644
--- a/.gitea/workflows/deploy-stack.yml
+++ b/.gitea/workflows/deploy-stack.yml
@@ -67,6 +67,13 @@ on:
         required: false
         type: string
         default: ""
+    secrets:
+      RUNNER_REPO_PAT:
+        description: |
+          PAT used in the absolute-URL form of `uses:` to clone composite actions
+          from `Charlie/project-charlie`. Set as a Charlie org-level secret;
+          callers pass via `secrets: inherit` (or explicitly).
+        required: true
 
 jobs:
   deploy: