Gitea secrets are case-sensitive. The encrypted secret in DB is named GITEATOKEN (uppercase). Workflow was using giteatoken (lowercase) which caused decryption failures in Gitea runner. Also unblocked stuck action_run #166 in database (status=1 queued).