From 58861d99a8ed0e22ce9b65df80760faf9180d4f5 Mon Sep 17 00:00:00 2001 From: Lucas Berger Date: Thu, 11 Jun 2026 19:27:03 -0400 Subject: [PATCH] fix(08-fix): WR-05 bind REGISTRY_PAT via env: and pipe with printf for docker login --- .gitea/workflows/publish.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml index 001de32..5817349 100644 --- a/.gitea/workflows/publish.yml +++ b/.gitea/workflows/publish.yml @@ -59,8 +59,15 @@ jobs: # Secret is named REGISTRY_PAT (not GITEA_REGISTRY_PAT): Gitea reserves the GITEA_ prefix # for secret names, so the GITEA_-prefixed name cannot be created. - name: Docker login + # Bind the secret through env: so it is never substituted into the rendered + # script body. Read it as $REGISTRY_PAT and pipe with printf '%s' (echo is not + # safe for arbitrary strings — a trailing newline or shell-significant char + # would mangle the password into a confusing `unauthorized`) (WR-05). + env: + REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }} run: | - echo "${{ secrets.REGISTRY_PAT }}" | \ + set -euo pipefail + printf '%s' "$REGISTRY_PAT" | \ docker login git.bergerhouse.net \ --username luckberg \ --password-stdin