From dacb100218fe63c8a664748d4598e06840fe37a5 Mon Sep 17 00:00:00 2001
From: Marc Mintel <marc@mintel.me>
Date: Tue, 3 Mar 2026 20:26:58 +0100
Subject: [PATCH] fix(ci): fix npm token secret format and unify chromium
 install

---
 .gitea/workflows/ci.yml     | 39 ++++++++++++++++++++++---------------
 .gitea/workflows/deploy.yml |  2 +-
 2 files changed, 24 insertions(+), 17 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 7879d207..899bc27f 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -25,28 +25,35 @@ jobs:
         with:
           node-version: 20
 
-      - name: 🔐 Configure Private Registry
+      - name: 🔐 Registry Auth
         run: |
           echo "@mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm" > .npmrc
           echo "//git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> .npmrc
-
       - name: Install dependencies
-        run: pnpm install --no-frozen-lockfile
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: 🌐 Install Chromium (Native)
         run: |
-          apt-get update && apt-get install -y gnupg wget ca-certificates
-          mkdir -p /etc/apt/keyrings
-          KEY_ID="82BB6851C64F6880"
-          wget -qO- "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x$KEY_ID" | gpg --dearmor > /etc/apt/keyrings/xtradeb.gpg
-          CODENAME=$(. /etc/os-release && echo $VERSION_CODENAME)
-          echo "deb [signed-by=/etc/apt/keyrings/xtradeb.gpg] http://ppa.launchpad.net/xtradeb/apps/ubuntu $CODENAME main" > /etc/apt/sources.list.d/xtradeb-ppa.list
-          printf "Package: *\nPin: release o=LP-PPA-xtradeb-apps\nPin-Priority: 1001\n" > /etc/apt/preferences.d/xtradeb
+          pnpm store prune
+          pnpm install --no-frozen-lockfile
+
+      - name: 🌐 Install Chromium (Native & ARM64)
+        run: |
+          rm -f /etc/apt/apt.conf.d/docker-clean
           apt-get update
-          apt-get install -y chromium
-          ln -sf /usr/bin/chromium /usr/bin/google-chrome
+          apt-get install -y gnupg wget ca-certificates
+          OS_ID=$(. /etc/os-release && echo $ID)
+          CODENAME=$(. /etc/os-release && echo $VERSION_CODENAME)
+          if [ "$OS_ID" = "debian" ]; then
+            apt-get install -y chromium
+          else
+            mkdir -p /etc/apt/keyrings
+            KEY_ID="82BB6851C64F6880"
+            wget -qO- "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x$KEY_ID" | gpg --dearmor > /etc/apt/keyrings/xtradeb.gpg
+            echo "deb [signed-by=/etc/apt/keyrings/xtradeb.gpg] http://ppa.launchpad.net/xtradeb/apps/ubuntu $CODENAME main" > /etc/apt/sources.list.d/xtradeb-ppa.list
+            printf "Package: *\nPin: release o=LP-PPA-xtradeb-apps\nPin-Priority: 1001\n" > /etc/apt/preferences.d/xtradeb
+            apt-get update
+            apt-get install -y --allow-downgrades chromium
+          fi
+          [ -f /usr/bin/chromium ] && ln -sf /usr/bin/chromium /usr/bin/google-chrome
+          [ -f /usr/bin/chromium ] && ln -sf /usr/bin/chromium /usr/bin/chromium-browser
           
       - name: 🧪 QA Checks
         env:
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 2254c053..55244a45 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -225,7 +225,7 @@ jobs:
             UMAMI_API_ENDPOINT=${{ secrets.UMAMI_API_ENDPOINT || vars.UMAMI_API_ENDPOINT || 'https://analytics.infra.mintel.me' }}
           tags: git.infra.mintel.me/mmintel/klz-2026:${{ needs.prepare.outputs.image_tag }}
           secrets: |
-            NPM_TOKEN
+            NPM_TOKEN=${{ secrets.NPM_TOKEN }}
 
   # ──────────────────────────────────────────────────────────────────────────────
   # JOB 4: Deploy