actions/checkout persists GITEA_TOKEN as an http.extraheader, which takes precedence over the token in the remote URL. Gitea doesn't fire workflows for pushes made with GITEA_TOKEN, so the refreshed data never deployed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>