From 45b7f8ca617895d83ad472f8de6100a9e1442b4a Mon Sep 17 00:00:00 2001
From: Rock <locartrock@gmail.com>
Date: Mon, 7 Sep 2026 06:48:25 +0000
Subject: [PATCH] fix: use env vars for docker registry credentials (#4)

Fix registry login by passing FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment variables instead of direct secret interpolation.

Uses the proven pattern from riotpiao.com reference commit.

This prevents credentials from being exposed in logs or shell history while keeping the standard docker login approach.

After merge + org-level secrets configured:
- All repos inherit FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN
- CI validates credentials exist before docker login
- Image pushed to registry on main push

---------

Co-authored-by: Test <test@example.com>
Reviewed-on: https://forgejo.riotpiao.com/rock/poimen-workflows/pulls/4
---
 .gitea/workflows/ci.yaml | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 9a074fc..2fa621f 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -25,10 +25,10 @@ jobs:
       - name: Download dependencies
         run: go mod download
 
-      - name: Vet
+      - name: Go vet
         run: go vet ./...
 
-      - name: Test
+      - name: Go test
         run: go test ./...
 
       - name: Build binary
@@ -52,15 +52,24 @@ jobs:
 
       - name: Registry login
         run: |
-          echo "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" | docker login "${REGISTRY}" \
-            --username "${{ secrets.FORGEJO_REGISTRY_USER }}" --password-stdin
+          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
+            --username "${REGISTRY_USER}" --password-stdin
+        env:
+          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
 
       - name: Build and push image
         run: |
-          docker build \
+          docker build --no-cache \
             -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
             -t "${IMAGE}:latest" \
             .
+
+      - name: Push Docker image
+        run: |
           docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
           docker push "${IMAGE}:latest"
-          echo "✓ Pushed ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+          echo "✓ Image pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+
+      - name: Prune unused images
+        run: docker image prune -a --force 2>&1 | tail -3 || true