Docs: full Gitea URL in uses: examples; deploy key is required (was 'optional')

README.md

@@ -39,14 +39,18 @@ jobs:
         with:
           fetch-depth: 0            # full history + the tag ref (git archive needs this)
 
-      - uses: wordpress/wp-release-ci@v1   # PIN to a tag or SHA — never a moving branch
+      - uses: https://gitea.mulligan.casa/wordpress/wp-release-ci@v1   # full Gitea URL; PIN the ref
         with:
           channel_deploy_key: ${{ secrets.CHANNEL_DEPLOY_KEY }}
 ```
 
-> **Pin the ref.** Reference the action by a release tag (`@v1`) or a commit SHA, not by
+> **Use the full Gitea URL.** On Gitea Actions a bare `owner/repo` in `uses:` resolves against
-> `@main`. A composite action runs shell from its own checkout inside your repo's job; pinning
+> **github.com**, not this instance — it must be the full `https://gitea.mulligan.casa/…@ref` form,
-> is what stops an upstream change from silently altering what runs against your secrets.
+> or the runner tries to check the action out from GitHub and the job fails.
+>
+> **Pin the ref** to a release tag (`@v1`) or commit SHA, never `@main`. A composite action runs
+> shell from its own checkout inside your repo's job; pinning stops an upstream change from
+> silently altering what runs against your secrets.
 
 If your project bundles a Vite app (`app_build: true`), also add a `actions/setup-node@v4` step
 before the release step.
@@ -164,8 +168,8 @@ single `screenshot_url` built from `screenshot.png` at the repo root when presen
 
 - **`CHANNEL_DEPLOY_KEY`** (secret) — an SSH private key whose **public** half is registered as a
   **deploy key with WRITE access on the channel repo** (e.g. `aa/maineaa-updates`). This is what
-  lets the pipeline push the new zip + manifest. Without it, the pipeline still cuts the Gitea
+  lets the pipeline push the new zip + manifest. It is **required** — the publish step hard-fails
-  release on the source repo but **skips** the channel publish.
+  if it's unset (`channel:` is a required target, so reaching it is required too).
 - Optionally `CHANNEL_SSH_PORT`, `CHANNEL_BRANCH`, `CHANNEL_GIT_NAME` (repo variables) if you
   need non-default values.
 

action.yml

@@ -7,7 +7,7 @@ description: "Package and publish a WordPress plugin/theme release to a Gitea re
 # Minimal usage:
 #   - uses: actions/checkout@v4
 #     with: { fetch-depth: 0 }
-#   - uses: wordpress/wp-release-ci@v1        # pin to a tag or SHA, not a branch
+#   - uses: https://gitea.mulligan.casa/wordpress/wp-release-ci@v1   # full Gitea URL (a bare owner/repo resolves from github); pin the ref
 #     with:
 #       channel_deploy_key: ${{ secrets.CHANNEL_DEPLOY_KEY }}
 #
@@ -16,7 +16,7 @@ description: "Package and publish a WordPress plugin/theme release to a Gitea re
 
 inputs:
   channel_deploy_key:
-    description: "SSH private key with WRITE access to the channel repo. Without it, the channel-publish step is skipped (Gitea release still cut)."
+    description: "SSH private key with WRITE access to the channel repo. Required — the channel publish hard-fails without it."
     required: true
   channel_ssh_port:
     description: "SSH port of the Gitea host for the channel push."