From 3a45b3d8b46d055fe2f72aca0a55b7ac12990ee3 Mon Sep 17 00:00:00 2001
From: Mike Mulligan <mike@belineperspectives.com>
Date: Wed, 15 Jul 2026 17:38:06 -0400
Subject: [PATCH] Docs: full Gitea URL in uses: examples; deploy key is
 required (was 'optional')

---
 README.md  | 16 ++++++++++------
 action.yml |  4 ++--
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 558f583..a2ab013 100644
--- a/README.md
+++ b/README.md
@@ -39,14 +39,18 @@ jobs:
         with:
           fetch-depth: 0            # full history + the tag ref (git archive needs this)
 
-      - uses: wordpress/wp-release-ci@v1   # PIN to a tag or SHA — never a moving branch
+      - uses: https://gitea.mulligan.casa/wordpress/wp-release-ci@v1   # full Gitea URL; PIN the ref
         with:
           channel_deploy_key: ${{ secrets.CHANNEL_DEPLOY_KEY }}
 ```
 
-> **Pin the ref.** Reference the action by a release tag (`@v1`) or a commit SHA, not by
-> `@main`. A composite action runs shell from its own checkout inside your repo's job; pinning
-> is what stops an upstream change from silently altering what runs against your secrets.
+> **Use the full Gitea URL.** On Gitea Actions a bare `owner/repo` in `uses:` resolves against
+> **github.com**, not this instance — it must be the full `https://gitea.mulligan.casa/…@ref` form,
+> or the runner tries to check the action out from GitHub and the job fails.
+>
+> **Pin the ref** to a release tag (`@v1`) or commit SHA, never `@main`. A composite action runs
+> shell from its own checkout inside your repo's job; pinning stops an upstream change from
+> silently altering what runs against your secrets.
 
 If your project bundles a Vite app (`app_build: true`), also add a `actions/setup-node@v4` step
 before the release step.
@@ -164,8 +168,8 @@ single `screenshot_url` built from `screenshot.png` at the repo root when presen
 
 - **`CHANNEL_DEPLOY_KEY`** (secret) — an SSH private key whose **public** half is registered as a
   **deploy key with WRITE access on the channel repo** (e.g. `aa/maineaa-updates`). This is what
-  lets the pipeline push the new zip + manifest. Without it, the pipeline still cuts the Gitea
-  release on the source repo but **skips** the channel publish.
+  lets the pipeline push the new zip + manifest. It is **required** — the publish step hard-fails
+  if it's unset (`channel:` is a required target, so reaching it is required too).
 - Optionally `CHANNEL_SSH_PORT`, `CHANNEL_BRANCH`, `CHANNEL_GIT_NAME` (repo variables) if you
   need non-default values.
 
diff --git a/action.yml b/action.yml
index 38e54e6..76736aa 100644
--- a/action.yml
+++ b/action.yml
@@ -7,7 +7,7 @@ description: "Package and publish a WordPress plugin/theme release to a Gitea re
 # Minimal usage:
 #   - uses: actions/checkout@v4
 #     with: { fetch-depth: 0 }
-#   - uses: wordpress/wp-release-ci@v1        # pin to a tag or SHA, not a branch
+#   - uses: https://gitea.mulligan.casa/wordpress/wp-release-ci@v1   # full Gitea URL (a bare owner/repo resolves from github); pin the ref
 #     with:
 #       channel_deploy_key: ${{ secrets.CHANNEL_DEPLOY_KEY }}
 #
@@ -16,7 +16,7 @@ description: "Package and publish a WordPress plugin/theme release to a Gitea re
 
 inputs:
   channel_deploy_key:
-    description: "SSH private key with WRITE access to the channel repo. Without it, the channel-publish step is skipped (Gitea release still cut)."
+    description: "SSH private key with WRITE access to the channel repo. Required — the channel publish hard-fails without it."
     required: true
   channel_ssh_port:
     description: "SSH port of the Gitea host for the channel push."