2026-06-11 19:40:45 -04:00
1 changed files with 8 additions and 1 deletions
@@ -59,8 +59,15 @@ jobs:
      # Secret is named REGISTRY_PAT (not GITEA_REGISTRY_PAT): Gitea reserves the GITEA_ prefix
      # for secret names, so the GITEA_-prefixed name cannot be created.
      - name: Docker login
+        # Bind the secret through env: so it is never substituted into the rendered
+        # script body. Read it as $REGISTRY_PAT and pipe with printf '%s' (echo is not
+        # safe for arbitrary strings — a trailing newline or shell-significant char
+        # would mangle the password into a confusing `unauthorized`) (WR-05).
+        env:
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
        run: |
-          echo "${{ secrets.REGISTRY_PAT }}" | \
+          set -euo pipefail
+          printf '%s' "$REGISTRY_PAT" | \
          docker login git.bergerhouse.net \
            --username luckberg \
            --password-stdin