update validation

cmd/validate.go

@@ -141,9 +141,8 @@ type requiredSecret struct {
 // kforge.yml requires, based on what's enabled.
 func buildRequiredSecrets(cfg *config.KforgeConfig) []requiredSecret {
 	secrets := []requiredSecret{
-		// Always required — org level
-		{Name: "DOCKER_USERNAME", Location: "Gitea org secret", Required: true},
-		{Name: "DOCKER_PASSWORD", Location: "Gitea org secret", Required: true},
+		// kforge only needs these — DOCKER_USERNAME/PASSWORD are used by
+		// docker/login-action and docker/build-push-action, not by kforge itself.
 		{Name: "KFORGE_NODE_IP", Location: "Gitea org secret", Description: "Node IP written as the external-dns annotation target"},
 
 		// Always required — repo level

readme.md

@@ -637,11 +637,13 @@ kforge works with three categories of secrets, each living in the right place fo
 
 Set once at the organisation level; available to every repo automatically.
 
-| Secret | Purpose |
-|---|---|
-| `DOCKER_USERNAME` | Registry authentication |
-| `DOCKER_PASSWORD` | Registry authentication |
-| `KFORGE_NODE_IP` | Cluster node IP — written as the external-dns target annotation |
+| Secret | Used by | Purpose |
+|---|---|---|
+| `DOCKER_USERNAME` | `docker/login-action` | Registry authentication for image push |
+| `DOCKER_PASSWORD` | `docker/login-action` | Registry authentication for image push |
+| `KFORGE_NODE_IP` | kforge | Cluster node IP — written as the external-dns target annotation |
+
+`DOCKER_USERNAME` and `DOCKER_PASSWORD` are consumed by the Docker build steps in the generated workflow, not by kforge itself. `kforge validate` does not check for them.
 
 ### Category B — Gitea repo secrets