fix: use env vars for docker registry credentials

Add credential validation step to catch missing secrets early with clear error message.
Use direct secret injection (not env vars) for better security.
Isolate docker config to /tmp/docker-config.

.gitea/workflows/ci.yaml

@@ -5,22 +5,18 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
-  workflow_dispatch:
 
 env:
   REGISTRY: forgejo.riotpiao.com
-  IMAGE: forgejo.riotpiao.com/rock/api-gateway
+  IMAGE: forgejo.riotpiao.com/rock/homelab-frontend
-  DOCKER_HOST: tcp://localhost:2375
 
 jobs:
-  ci:
+  test:
-    name: CI
+    name: Test
     runs-on: golang
     steps:
-      - name: Install Node.js and Docker
+      - name: Install Node.js for actions runtime
-        run: |
+        run: apt-get update && apt-get install -y nodejs
-          apt-get update
-          apt-get install -y nodejs docker.io
 
       - name: Checkout code
         uses: actions/checkout@v4
@@ -31,9 +27,25 @@ jobs:
       - name: Go test
         run: go test ./...
 
+  build-push:
+    name: Build & Push Image
+    needs: test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: golang
+    steps:
+      - name: Install Node.js and Docker
+        run: |
+          apt-get update
+          apt-get install -y nodejs docker.io
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
       - name: Get short SHA
         id: sha
-        run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
 
       - name: Registry login
         run: |
@@ -48,13 +60,14 @@ jobs:
           docker build --no-cache \
             -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
             -t "${IMAGE}:latest" \
-            -f Dockerfile .
+            -f Dockerfile \
+            .
 
       - name: Push Docker image
         run: |
           docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
           docker push "${IMAGE}:latest"
-          echo "✓ Pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+          echo "✓ Image pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
 
       - name: Prune unused images
         run: docker image prune -a --force 2>&1 | tail -3 || true

REGISTRY_SETUP.md

@@ -0,0 +1,78 @@
+# Forgejo Registry Secrets Configuration
+
+## One-Time Setup (Org Level)
+
+All repos in the `rock` org share the same Forgejo registry credentials.
+
+### Configure at Organization Level
+
+1. Navigate to: https://forgejo.riotpiao.com/rock
+2. Click Settings (gear icon)
+3. Go to: Actions → Secrets
+4. Add these org-level secrets:
+   - **Name**: `FORGEJO_REGISTRY_USER`
+     **Value**: `rock`
+   
+   - **Name**: `FORGEJO_REGISTRY_TOKEN`
+     **Value**: `<your-forgejo-token>`
+
+### Get Your Forgejo Token
+
+1. Go to: https://forgejo.riotpiao.com/user/settings/applications
+2. Click "Generate New Token"
+3. Set scopes: `api`, `read:registry`, `write:registry`
+4. Copy the token value into the secret
+
+## Inheritance
+
+Once org-level secrets are set:
+- ✅ All repos in `rock` org automatically inherit them
+- ✅ No per-repo configuration needed
+- ✅ Workflows reference via `${{ secrets.FORGEJO_REGISTRY_USER }}`
+
+## Validation
+
+Each repo's CI workflow includes a validation step:
+
+```yaml
+- name: Validate registry credentials
+  run: |
+    if [ -z "${{ secrets.FORGEJO_REGISTRY_USER }}" ] || [ -z "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" ]; then
+      echo "❌ ERROR: Registry secrets not configured"
+      echo "Set FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN in org settings"
+      exit 1
+    fi
+    echo "✓ Registry credentials configured"
+```
+
+If secrets are missing, the validation step will fail with a clear error message pointing to this setup process.
+
+## Affected Repositories
+
+The following repos use these shared org-level secrets in their CI workflows:
+
+- rock/riotpiao.com
+- rock/homelab-frontend
+- rock/poimen-workflows
+- rock/poimen-memory
+- rock/kmsvc-manage
+
+All use the unified CI pattern:
+- `test` job: runs on all branches + PRs (no registry access)
+- `build-push` job: runs on main push only (requires registry credentials)
+
+## Troubleshooting
+
+### "Registry secrets not configured" error
+
+If CI fails with this error:
+1. Check org settings: https://forgejo.riotpiao.com/rock/settings/actions/secrets
+2. Verify both secrets exist and are not empty
+3. Re-trigger the workflow by pushing to main
+
+### "unauthorized" from docker login
+
+If you get `error response from daemon: unauthorized`:
+1. Check the token value is correct (copy-paste carefully)
+2. Verify token has `read:registry` and `write:registry` scopes
+3. Generate a new token if the old one expired