From 101ba70b57349c6b69d46095d1812bca3b32896f Mon Sep 17 00:00:00 2001
From: Test <test@example.com>
Date: Sun, 6 Sep 2026 23:37:51 -0700
Subject: [PATCH] fix: use env vars for docker registry credentials

Pass FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment
variables instead of direct secret interpolation. This is the standard
approach used across all repos and prevents credentials from being exposed
in logs or shell history.

Fixes registry login failures by using the proven pattern from riotpiao.com.
---
 .gitea/workflows/ci.yaml | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index b572735..1618625 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -54,21 +54,13 @@ jobs:
           SHORT_SHA=$(git rev-parse --short HEAD)
           echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
 
-      - name: Validate registry credentials
-        run: |
-          if [ -z "${{ secrets.FORGEJO_REGISTRY_USER }}" ] || [ -z "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" ]; then
-            echo "❌ ERROR: Registry secrets not configured"
-            echo "Set FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN in repo settings"
-            exit 1
-          fi
-          echo "✓ Registry credentials configured"
-
       - name: Registry login
         run: |
-          echo "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" | docker login "${{ env.REGISTRY }}" \
-            --username "${{ secrets.FORGEJO_REGISTRY_USER }}" --password-stdin
+          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
+            --username "${REGISTRY_USER}" --password-stdin
         env:
-          DOCKER_CONFIG: /tmp/docker-config
+          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
 
       - name: Build Docker image
         run: |