From c113c277438269c169f38b95e7674b43d8972310 Mon Sep 17 00:00:00 2001
From: Marc Mintel <marc@mintel.me>
Date: Tue, 12 May 2026 12:08:43 +0200
Subject: [PATCH] fix: use verified registry token for docker build to avoid
 401

---
 .gitea/workflows/deploy.yml | 15 +++++++++++++--
 scripts/registry-auth.sh    |  6 ++++++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 7089027bc..0371db30b 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -178,6 +178,17 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+
+      - name: 🔐 Registry Auth
+        id: auth
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GITEA_PAT: ${{ secrets.GITEA_PAT }}
+          MINTEL_PRIVATE_TOKEN: ${{ secrets.MINTEL_PRIVATE_TOKEN }}
+          MINTEL_REGISTRY_TOKEN: ${{ secrets.MINTEL_REGISTRY_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bash scripts/registry-auth.sh
+
       - name: 🐳 Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: 🔐 Registry Login
@@ -194,10 +205,10 @@ jobs:
             NEXT_PUBLIC_TARGET=${{ needs.prepare.outputs.target }}
             UMAMI_WEBSITE_ID=${{ secrets.UMAMI_WEBSITE_ID || vars.UMAMI_WEBSITE_ID }}
             UMAMI_API_ENDPOINT=${{ secrets.UMAMI_API_ENDPOINT || vars.UMAMI_API_ENDPOINT || 'https://analytics.infra.mintel.me' }}
-            NPM_TOKEN=${{ secrets.NPM_TOKEN }}
+            NPM_TOKEN=${{ steps.auth.outputs.working_token }}
           tags: registry.infra.mintel.me/mintel/e-tib.com:${{ needs.prepare.outputs.image_tag }}
           secrets: |
-            "NPM_TOKEN=${{ secrets.NPM_TOKEN }}"
+            "NPM_TOKEN=${{ steps.auth.outputs.working_token }}"
 
   # ──────────────────────────────────────────────────────────────────────────────
   # JOB 4: Deploy
diff --git a/scripts/registry-auth.sh b/scripts/registry-auth.sh
index 8cbf383f9..893ffc436 100755
--- a/scripts/registry-auth.sh
+++ b/scripts/registry-auth.sh
@@ -102,3 +102,9 @@ echo "✅ .npmrc hardened with verified token on ${WORKING_DOMAIN}."
 echo "--- Generated .npmrc (masked) ---"
 sed 's/_authToken=.*/_authToken=********/' .npmrc
 echo "--------------------------------"
+
+# --- OUTPUT FOR CI ---
+if [ -n "$GITHUB_OUTPUT" ]; then
+    echo "working_token=${WORKING_TOKEN}" >> "$GITHUB_OUTPUT"
+    echo "working_domain=${WORKING_DOMAIN}" >> "$GITHUB_OUTPUT"
+fi