From 194976f13f3263a2de4160b2da4f41e9d2ff2ce6 Mon Sep 17 00:00:00 2001
From: Test <test@example.com>
Date: Sun, 6 Sep 2026 23:33:48 -0700
Subject: [PATCH] fix: validate registry credentials before docker login

Add credential validation step to catch missing secrets early with clear error message.
Use direct secret injection (not env vars) for better security.
Isolate docker config to /tmp/docker-config.
---
 .gitea/workflows/ci.yaml | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 1618625..b572735 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -54,13 +54,21 @@ jobs:
           SHORT_SHA=$(git rev-parse --short HEAD)
           echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
 
+      - name: Validate registry credentials
+        run: |
+          if [ -z "${{ secrets.FORGEJO_REGISTRY_USER }}" ] || [ -z "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" ]; then
+            echo "❌ ERROR: Registry secrets not configured"
+            echo "Set FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN in repo settings"
+            exit 1
+          fi
+          echo "✓ Registry credentials configured"
+
       - name: Registry login
         run: |
-          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
-            --username "${REGISTRY_USER}" --password-stdin
+          echo "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" | docker login "${{ env.REGISTRY }}" \
+            --username "${{ secrets.FORGEJO_REGISTRY_USER }}" --password-stdin
         env:
-          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
-          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+          DOCKER_CONFIG: /tmp/docker-config
 
       - name: Build Docker image
         run: |