fix: use verified registry token for docker build to avoid 401

.gitea/workflows/deploy.yml

@@ -178,6 +178,17 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+
+      - name: 🔐 Registry Auth
+        id: auth
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GITEA_PAT: ${{ secrets.GITEA_PAT }}
+          MINTEL_PRIVATE_TOKEN: ${{ secrets.MINTEL_PRIVATE_TOKEN }}
+          MINTEL_REGISTRY_TOKEN: ${{ secrets.MINTEL_REGISTRY_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bash scripts/registry-auth.sh
+
       - name: 🐳 Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: 🔐 Registry Login
@@ -194,10 +205,10 @@ jobs:
             NEXT_PUBLIC_TARGET=${{ needs.prepare.outputs.target }}
             UMAMI_WEBSITE_ID=${{ secrets.UMAMI_WEBSITE_ID || vars.UMAMI_WEBSITE_ID }}
             UMAMI_API_ENDPOINT=${{ secrets.UMAMI_API_ENDPOINT || vars.UMAMI_API_ENDPOINT || 'https://analytics.infra.mintel.me' }}
-            NPM_TOKEN=${{ secrets.NPM_TOKEN }}
+            NPM_TOKEN=${{ steps.auth.outputs.working_token }}
           tags: registry.infra.mintel.me/mintel/e-tib.com:${{ needs.prepare.outputs.image_tag }}
           secrets: |
-            "NPM_TOKEN=${{ secrets.NPM_TOKEN }}"
+            "NPM_TOKEN=${{ steps.auth.outputs.working_token }}"
 
   # ──────────────────────────────────────────────────────────────────────────────
   # JOB 4: Deploy

scripts/registry-auth.sh

@@ -102,3 +102,9 @@ echo "✅ .npmrc hardened with verified token on ${WORKING_DOMAIN}."
 echo "--- Generated .npmrc (masked) ---"
 sed 's/_authToken=.*/_authToken=********/' .npmrc
 echo "--------------------------------"
+
+# --- OUTPUT FOR CI ---
+if [ -n "$GITHUB_OUTPUT" ]; then
+    echo "working_token=${WORKING_TOKEN}" >> "$GITHUB_OUTPUT"
+    echo "working_domain=${WORKING_DOMAIN}" >> "$GITHUB_OUTPUT"
+fi