From a940e8497011bb8106b151dd5f8eeeeda054780f Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Sun, 6 Sep 2026 23:32:42 -0700
Subject: [PATCH] fix: validate registry credentials before docker login
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Problem: Registry login fails silently if secrets aren't configured
- Empty FORGEJO_REGISTRY_USER/TOKEN → docker login hangs/fails
- No clear error message about missing credentials

Solution: Add validation step that checks credentials exist
- Fails early with clear error if secrets missing
- Shows how to configure in repo settings
- Uses direct secret injection (not via env vars)
- Isolates docker config to /tmp/docker-config

Result: CI will fail fast with actionable error if credentials missing
---
 .gitea/workflows/build.yaml | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 155976b..56a6f6a 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -49,27 +49,35 @@ jobs:
           SHORT_SHA=$(git rev-parse --short HEAD)
           echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
 
+      - name: Validate registry credentials
+        run: |
+          if [ -z "${{ secrets.FORGEJO_REGISTRY_USER }}" ] || [ -z "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" ]; then
+            echo "❌ ERROR: Registry secrets not configured"
+            echo "Set FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN in repo settings"
+            exit 1
+          fi
+          echo "✓ Registry credentials configured"
+
       - name: Registry login
         run: |
-          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
-            --username "${REGISTRY_USER}" --password-stdin
+          echo "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" | docker login "${{ env.REGISTRY }}" \
+            --username "${{ secrets.FORGEJO_REGISTRY_USER }}" --password-stdin
         env:
-          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
-          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+          DOCKER_CONFIG: /tmp/docker-config
 
       - name: Build Docker image
         run: |
           docker build --no-cache \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" \
+            -t "${{ env.IMAGE }}:${{ steps.sha.outputs.short_sha }}" \
+            -t "${{ env.IMAGE }}:latest" \
             -f Dockerfile \
             .
 
       - name: Push Docker image
         run: |
-          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE}:latest"
-          echo "✓ Image pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+          docker push "${{ env.IMAGE }}:${{ steps.sha.outputs.short_sha }}"
+          docker push "${{ env.IMAGE }}:latest"
+          echo "✓ Image pushed: ${{ env.IMAGE }}:${{ steps.sha.outputs.short_sha }}"
 
       - name: Prune unused images
         run: docker image prune -a --force 2>&1 | tail -3 || true