feat(release): the Forgejo token from Proton Pass as well

tool/with_signing_keys.sh reads the token releases publish with from its
login in the vault Infra and hands it over as HALKYON_FORGEJO_TOKEN, but
for a dry run, so a release asks for no secret at all.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

tool/with_signing_keys.sh

@@ -5,7 +5,8 @@
 # tmpfs only the own user reads), handed to the release tool by the variables it reads
 # their paths from, and removed however the run ends. Their passwords, each item's hidden
 # field "Password", go to it in its environment (<keystore variable>_PASSWORD), so it
-# asks for none; a dry run asks for no secret, and gets none.
+# asks for none, nor for the Forgejo token, a login's password in the vault Infra
+# (HALKYON_FORGEJO_TOKEN); a dry run asks for no secret, and gets none.
 #
 #   tool/with_signing_keys.sh <app> [release.dart's arguments]
 #   tool/with_signing_keys.sh train minor --dry-run
@@ -36,6 +37,10 @@ case "$app" in
 esac
 # The F-Droid repository's index key, the same for every app listed there.
 readonly fdroid_item='Halkyon Learn – F-Droid index keystore'
+# The Forgejo token releases publish with (write:repository), a login's password in
+# the vault Infra (its folder API Tokens), made for this laptop.
+readonly token_vault='Infra'
+readonly token_item='Forgejo Token halkyon_learn release signing script (melchior)'
 
 for tool in pass-cli jq; do
   command -v "$tool" >/dev/null || fail "$tool is missing."
@@ -73,6 +78,16 @@ password() {
   printf '%s' "$value"
 }
 
+# The Forgejo token: the password of the login $token_item in $token_vault.
+forgejo_token() {
+  local value
+  value=$(pass-cli item view --vault-name "$token_vault" --item-title "$token_item" --output json |
+    jq -r '.item.content.content.Login.password // empty') ||
+    fail "Can't read the item \"$token_item\" in $token_vault (pass-cli login?)."
+  [ -n "$value" ] || fail "The item \"$token_item\" in $token_vault has no password."
+  printf '%s' "$value"
+}
+
 echo "▸ Fetching the signing keys from $vault"
 fetch "$app_item" android-release.p12 "$keys/android-release.p12"
 fetch "$fdroid_item" fdroid-index.p12 "$keys/fdroid-index.p12"
@@ -88,7 +103,9 @@ if ! $dry_run; then
   fdroid_password=$(password "$fdroid_item")
   export "${app_variable}_PASSWORD=$app_password"
   export HALKYON_FDROID_KEYSTORE_PASSWORD="$fdroid_password"
-  unset app_password fdroid_password
+  token=$(forgejo_token)
+  export HALKYON_FORGEJO_TOKEN="$token"
+  unset app_password fdroid_password token
 fi
 status=0
 dart run tool/release.dart "$app" "$@" || status=$?