From 6e80c91f7d09346e22681d1a6fed02faeffd876e Mon Sep 17 00:00:00 2001
From: Marc Mintel <marc@mintel.me>
Date: Wed, 4 Mar 2026 15:47:04 +0100
Subject: [PATCH] fix(ci): use heredoc for SSH docker login to avoid token
 escaping issues

---
 .gitea/workflows/deploy.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 080a2e74..0a4cd375 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -398,7 +398,13 @@ jobs:
           scp docker-compose.yml root@alpha.mintel.me:$SITE_DIR/docker-compose.yml
           
           # Execute remote commands
-          ssh root@alpha.mintel.me "cd $SITE_DIR && echo \"$REGISTRY_PASS\" | docker login git.infra.mintel.me -u \"$REGISTRY_USER\" --password-stdin && docker compose -p \"${{ needs.prepare.outputs.project_name }}\" --env-file \"$ENV_FILE\" pull && docker compose -p \"${{ needs.prepare.outputs.project_name }}\" --env-file \"$ENV_FILE\" up -d --remove-orphans"
+          ssh root@alpha.mintel.me bash <<DEPLOYEOF
+          set -e
+          cd $SITE_DIR
+          printf '%s' '$REGISTRY_PASS' | docker login git.infra.mintel.me -u '$REGISTRY_USER' --password-stdin
+          docker compose -p '${{ needs.prepare.outputs.project_name }}' --env-file '$ENV_FILE' pull
+          docker compose -p '${{ needs.prepare.outputs.project_name }}' --env-file '$ENV_FILE' up -d --remove-orphans
+          DEPLOYEOF
           
           # Sanitize Payload Migrations: Replace 'dev' push entries with proper migration names.
           # Without this, Payload prompts interactively for confirmation and blocks forever in Docker.