From 9dfa45f901fc8059166bbef57e8fd19c0287fb54 Mon Sep 17 00:00:00 2001
From: bitdeals <ostapkolbasenko@meta.ua>
Date: Fri, 7 Aug 2026 13:39:55 +0000
Subject: [PATCH] ci: pass the registry password on stdin, fail on a failed
 push

A password in argv is world-readable through /proc/PID/cmdline while the
command runs; docker warns about it for that reason. The two pushes are joined
with && so the step's outcome is explicit rather than resting on whatever -e
flag the runner's shell happens to carry.
---
 .gitea/workflows/build.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index a5b635c..720bb8c 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -31,9 +31,9 @@ jobs:
             --tag "${REGISTRY}/${REPOSITORY##*/}:latest"
       - name: Docker login
         run: |
-          docker login --username "$USER" --password "$PASS" "$REGISTRY"
+          echo "$PASS" | docker login --username "$USER" --password-stdin "$REGISTRY"
       - name: Push images to registry
         run: |
-          docker push "${REGISTRY}/${REPOSITORY##*/}:${VERSION}.${COMMIT::7}" ; \
+          docker push "${REGISTRY}/${REPOSITORY##*/}:${VERSION}.${COMMIT::7}" && \
           docker push "${REGISTRY}/${REPOSITORY##*/}:latest"