fix railway deploy auth env precedence

Author: Dieg0Code

.github/workflows/deploy-railway-app.yml

@@ -26,8 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     env:
-      # Keep both names because Railway CLI behavior varies across versions.
-      RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
+      # Workspace-scoped tokens must be passed as RAILWAY_API_TOKEN.
       RAILWAY_API_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
       RAILWAY_PROJECT_ID: ${{ secrets.RAILWAY_PROJECT_ID }}
       RAILWAY_ENVIRONMENT_ID: ${{ secrets.RAILWAY_ENVIRONMENT_ID }}
@@ -36,7 +35,7 @@ jobs:
     steps:
       - name: Validate Railway secrets
         run: |
-          test -n "${RAILWAY_TOKEN}" || (echo "Missing secret: RAILWAY_TOKEN" && exit 1)
+          test -n "${RAILWAY_API_TOKEN}" || (echo "Missing secret: RAILWAY_TOKEN" && exit 1)
           test -n "${RAILWAY_PROJECT_ID}" || (echo "Missing secret: RAILWAY_PROJECT_ID" && exit 1)
           test -n "${RAILWAY_ENVIRONMENT_ID}" || (echo "Missing secret: RAILWAY_ENVIRONMENT_ID" && exit 1)
           test -n "${RAILWAY_SERVICE_ID}" || (echo "Missing secret: RAILWAY_SERVICE_ID" && exit 1)
@@ -60,6 +59,10 @@ jobs:
 
       - name: Deploy to Railway (CI mode)
         run: |
+          # Some Railway CLI versions prefer RAILWAY_TOKEN when both are present.
+          # Unset it to force workspace-token auth via RAILWAY_API_TOKEN.
+          unset RAILWAY_TOKEN
+
           # Railway builder failures can be transient (container bootstrap/network).
           # Retry the deploy to reduce false-negative workflow failures.
           for attempt in 1 2 3; do