Gitea logs show: "decrypt secret giteatoken: failed to decrypt by secret, the key might be incorrect" - secrets must be encrypted with Gitea SECRET_KEY, not plaintext in DB. Solution: Use SSH git clone for checkout which requires no secrets. Runners are already registered with Gitea and have SSH access.