fix: validate registry credentials before docker login

Problem: Registry login fails silently if secrets aren't configured
- Empty FORGEJO_REGISTRY_USER/TOKEN → docker login hangs/fails
- No clear error message about missing credentials

Solution: Add validation step that checks credentials exist
- Fails early with clear error if secrets missing
- Shows how to configure in repo settings
- Uses direct secret injection (not via env vars)
- Isolates docker config to /tmp/docker-config

Result: CI will fail fast with actionable error if credentials missing

.gitea/workflows/build.yaml

@@ -49,27 +49,35 @@ jobs:
           SHORT_SHA=$(git rev-parse --short HEAD)
           echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
 
+      - name: Validate registry credentials
+        run: |
+          if [ -z "${{ secrets.FORGEJO_REGISTRY_USER }}" ] || [ -z "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" ]; then
+            echo "❌ ERROR: Registry secrets not configured"
+            echo "Set FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN in repo settings"
+            exit 1
+          fi
+          echo "✓ Registry credentials configured"
+
       - name: Registry login
         run: |
-          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
-            --username "${REGISTRY_USER}" --password-stdin
+          echo "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" | docker login "${{ env.REGISTRY }}" \
+            --username "${{ secrets.FORGEJO_REGISTRY_USER }}" --password-stdin
         env:
-          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
-          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+          DOCKER_CONFIG: /tmp/docker-config
 
       - name: Build Docker image
         run: |
           docker build --no-cache \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" \
+            -t "${{ env.IMAGE }}:${{ steps.sha.outputs.short_sha }}" \
+            -t "${{ env.IMAGE }}:latest" \
             -f Dockerfile \
             .
 
       - name: Push Docker image
         run: |
-          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE}:latest"
-          echo "✓ Image pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+          docker push "${{ env.IMAGE }}:${{ steps.sha.outputs.short_sha }}"
+          docker push "${{ env.IMAGE }}:latest"
+          echo "✓ Image pushed: ${{ env.IMAGE }}:${{ steps.sha.outputs.short_sha }}"
 
       - name: Prune unused images
         run: docker image prune -a --force 2>&1 | tail -3 || true