ci: pass the registry password on stdin, fail on a failed push

A password in argv is world-readable through /proc/PID/cmdline while the
command runs; docker warns about it for that reason. The two pushes are joined
with && so the step's outcome is explicit rather than resting on whatever -e
flag the runner's shell happens to carry.

.gitea/workflows/build.yaml

@@ -31,9 +31,9 @@ jobs:
             --tag "${REGISTRY}/${REPOSITORY##*/}:latest"
       - name: Docker login
         run: |
-          docker login --username "$USER" --password "$PASS" "$REGISTRY"
+          echo "$PASS" | docker login --username "$USER" --password-stdin "$REGISTRY"
       - name: Push images to registry
         run: |
-          docker push "${REGISTRY}/${REPOSITORY##*/}:${VERSION}.${COMMIT::7}" ; \
+          docker push "${REGISTRY}/${REPOSITORY##*/}:${VERSION}.${COMMIT::7}" && \
           docker push "${REGISTRY}/${REPOSITORY##*/}:latest"