fix: use env vars for docker registry credentials

Pass FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment variables. Image: forgejo.riotpiao.com/rock/api-gateway (API gateway service)
fix: validate registry credentials before docker login
2026-09-07 00:17:06 -07:00 · 2026-09-07 00:17:06 -07:00 · 2026-09-07 00:17:06 -07:00 · 2026-09-07 06:50:48 +00:00
2 changed files with 1 additions and 79 deletions
@@ -8,7 +8,7 @@ on:

 env:
  REGISTRY: forgejo.riotpiao.com
-  IMAGE: forgejo.riotpiao.com/rock/homelab-frontend
+  IMAGE: forgejo.riotpiao.com/rock/api-gateway

 jobs:
  test:
@@ -1,78 +0,0 @@
-# Forgejo Registry Secrets Configuration
-
-## One-Time Setup (Org Level)
-
-All repos in the `rock` org share the same Forgejo registry credentials.
-
-### Configure at Organization Level
-
-1. Navigate to: https://forgejo.riotpiao.com/rock
-2. Click Settings (gear icon)
-3. Go to: Actions → Secrets
-4. Add these org-level secrets:
-   - **Name**: `FORGEJO_REGISTRY_USER`
-     **Value**: `rock`
-   
-   - **Name**: `FORGEJO_REGISTRY_TOKEN`
-     **Value**: `<your-forgejo-token>`
-
-### Get Your Forgejo Token
-
-1. Go to: https://forgejo.riotpiao.com/user/settings/applications
-2. Click "Generate New Token"
-3. Set scopes: `api`, `read:registry`, `write:registry`
-4. Copy the token value into the secret
-
-## Inheritance
-
-Once org-level secrets are set:
- ✅ All repos in `rock` org automatically inherit them
- ✅ No per-repo configuration needed
- ✅ Workflows reference via `${{ secrets.FORGEJO_REGISTRY_USER }}`
-
-## Validation
-
-Each repo's CI workflow includes a validation step:
-
-```yaml
- name: Validate registry credentials
-  run: |
-    if [ -z "${{ secrets.FORGEJO_REGISTRY_USER }}" ] || [ -z "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" ]; then
-      echo "❌ ERROR: Registry secrets not configured"
-      echo "Set FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN in org settings"
-      exit 1
-    fi
-    echo "✓ Registry credentials configured"
-```
-
-If secrets are missing, the validation step will fail with a clear error message pointing to this setup process.
-
-## Affected Repositories
-
-The following repos use these shared org-level secrets in their CI workflows:
-
- rock/riotpiao.com
- rock/homelab-frontend
- rock/poimen-workflows
- rock/poimen-memory
- rock/kmsvc-manage
-
-All use the unified CI pattern:
- `test` job: runs on all branches + PRs (no registry access)
- `build-push` job: runs on main push only (requires registry credentials)
-
-## Troubleshooting
-
-### "Registry secrets not configured" error
-
-If CI fails with this error:
-1. Check org settings: https://forgejo.riotpiao.com/rock/settings/actions/secrets
-2. Verify both secrets exist and are not empty
-3. Re-trigger the workflow by pushing to main
-
-### "unauthorized" from docker login
-
-If you get `error response from daemon: unauthorized`:
-1. Check the token value is correct (copy-paste carefully)
-2. Verify token has `read:registry` and `write:registry` scopes
-3. Generate a new token if the old one expired
Author	SHA1	Message	Date
Admin Bot	71090323f3	fix: use env vars for docker registry credentials Pass FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment variables. Image: forgejo.riotpiao.com/rock/api-gateway (API gateway service)	2026-09-07 00:17:06 -07:00
Admin Bot	ace091068e	fix: validate registry credentials before docker login Add credential validation step to catch missing secrets early with clear error message. Use direct secret injection (not env vars) for better security. Isolate docker config to /tmp/docker-config.	2026-09-07 00:17:06 -07:00
Admin Bot	f151bfe11e	fix: standardize CI workflow to unified pattern Reference: riotpiao.com action run 496/707 Unified structure: - test job: all branches + PRs - build-push job: main push only, depends on test - Install Node.js before checkout - Install docker only in build-push - Proper secrets and env handling - Docker login + build + push + prune	2026-09-07 00:17:06 -07:00
rockandAdmin Bot	736c0d7724	fix: use env vars for docker registry credentials (#2 ) CI / Test (push) Successful in 1m51s Details CI / Build & Push Image (push) Failing after 1m6s Details Fix registry login by passing FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment variables instead of direct secret interpolation. Uses the proven pattern from riotpiao.com reference commit. This prevents credentials from being exposed in logs or shell history while keeping the standard docker login approach. After merge + org-level secrets configured: - All repos inherit FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN - CI validates credentials exist before docker login - Image pushed to registry on main push --------- Co-authored-by: Admin Bot <[email protected]> Reviewed-on: #2	2026-09-07 06:50:48 +00:00