ci: fix pipeline cache corruption and secrets warning

.gitea/workflows/deploy.yml

@@ -206,8 +206,8 @@ jobs:
             UMAMI_API_ENDPOINT=${{ secrets.UMAMI_API_ENDPOINT || vars.UMAMI_API_ENDPOINT || 'https://analytics.infra.mintel.me' }}
             NPM_TOKEN=${{ secrets.REGISTRY_PASS }}
           tags: registry.infra.mintel.me/mintel/klz-cables.com:${{ needs.prepare.outputs.image_tag }}
-          cache-from: type=registry,ref=registry.infra.mintel.me/mintel/klz-cables.com:buildcache
+          cache-from: type=registry,ref=registry.infra.mintel.me/mintel/klz-cables.com:buildcache-v2
-          cache-to: type=registry,ref=registry.infra.mintel.me/mintel/klz-cables.com:buildcache,mode=max
+          cache-to: type=registry,ref=registry.infra.mintel.me/mintel/klz-cables.com:buildcache-v2,mode=max
           secrets: |
             "NPM_TOKEN=${{ secrets.REGISTRY_PASS }}"
 

Dockerfile

@@ -8,7 +8,6 @@ ARG NEXT_PUBLIC_TARGET
 ARG DIRECTUS_URL
 ARG UMAMI_WEBSITE_ID
 ARG UMAMI_API_ENDPOINT
-ARG NPM_TOKEN
 
 # Environment variables for Next.js build
 ENV NEXT_PUBLIC_BASE_URL=$NEXT_PUBLIC_BASE_URL
@@ -25,7 +24,7 @@ COPY pnpm-lock.yaml package.json .npmrc* ./
 # Configure private registry and install dependencies
 RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
     --mount=type=secret,id=NPM_TOKEN \
-    export NPM_TOKEN=$(cat /run/secrets/NPM_TOKEN 2>/dev/null || echo $NPM_TOKEN) && \
+    export NPM_TOKEN=$(cat /run/secrets/NPM_TOKEN) && \
     echo "@mintel:registry=https://npm.infra.mintel.me" > .npmrc && \
     echo "//npm.infra.mintel.me/:_authToken=\${NPM_TOKEN}" >> .npmrc && \
     pnpm install --frozen-lockfile && \

app/[locale]/blog/[slug]/page.tsx

@@ -69,6 +69,11 @@ export default async function BlogPost({ params }: BlogPostProps) {
         category={post.frontmatter.category}
         readingTime={getReadingTime(post.content)}
       />
+      {(new Date(post.frontmatter.date) > new Date() || post.frontmatter.public === false) && (
+        <div className="bg-orange-500 text-white text-center py-2 px-4 font-bold text-sm tracking-wider uppercase relative z-50">
+          Preview (Not visible in production)
+        </div>
+      )}
       {/* Featured Image Header */}
       {post.frontmatter.featuredImage ? (
         <div className="relative w-full h-[70vh] min-h-[500px] overflow-hidden group">

app/[locale]/blog/page.tsx

@@ -75,9 +75,16 @@ export default async function BlogIndex({ params }: BlogIndexProps) {
 
           <Container className="relative z-10">
             <div className="max-w-4xl animate-slide-up">
-              <Badge variant="saturated" className="mb-4 md:mb-6">
+              <div className="flex flex-wrap items-center gap-3 mb-4 md:mb-6">
-                {t('featuredPost')}
+                <Badge variant="saturated">{t('featuredPost')}</Badge>
-              </Badge>
+                {featuredPost &&
+                  (new Date(featuredPost.frontmatter.date) > new Date() ||
+                    featuredPost.frontmatter.public === false) && (
+                    <Badge variant="accent" className="bg-orange-500 text-white border-none">
+                      Preview
+                    </Badge>
+                  )}
+              </div>
               {featuredPost && (
                 <>
                   <Heading level={1} className="text-white mb-4 md:mb-8">
@@ -168,6 +175,15 @@ export default async function BlogIndex({ params }: BlogIndexProps) {
                             {post.frontmatter.category}
                           </Badge>
                         )}
+                        {(new Date(post.frontmatter.date) > new Date() ||
+                          post.frontmatter.public === false) && (
+                          <Badge
+                            variant="accent"
+                            className="absolute top-3 right-3 md:top-6 md:right-6 shadow-lg bg-orange-500 text-white border-none"
+                          >
+                            Preview
+                          </Badge>
+                        )}
                       </div>
                     )}
                     <div className="p-5 md:p-10 flex flex-col flex-1">

data/blog/de/johannes-gleich-startet-als-senior-key-account-manager-durch.mdx

@@ -5,6 +5,7 @@ featuredImage: /uploads/2026/01/1767353529807.jpg
 locale: de
 category: Kabel Technologie
 excerpt: 'KLZ Cables startet mit einer starken Verstärkung ins neue Jahr: Johannes Gleich übernimmt die Rolle des Senior Key Account Managers. Erfahren Sie mehr über unseren neuen Experten für Infrastruktur und Energieversorger.'
+public: false
 ---
 # Herzlich willkommen bei KLZ: Johannes Gleich startet als Senior Key Account Manager durch
 

data/blog/en/johannes-gleich-starts-as-senior-key-account-manager.mdx

@@ -5,6 +5,7 @@ featuredImage: /uploads/2026/01/1767353529807.jpg
 locale: en
 category: Cable Technology
 excerpt: 'KLZ Cables kicks off the new year with a strong addition: Johannes Gleich takes on the role of Senior Key Account Manager. Learn more about our new expert for infrastructure and energy suppliers.'
+public: false
 ---
 # Welcome to KLZ: Johannes Gleich starts as Senior Key Account Manager
 

lib/blog.ts

@@ -2,6 +2,7 @@ import fs from 'fs';
 import path from 'path';
 import matter from 'gray-matter';
 import { mapSlugToFileSlug } from './slugs';
+import { config } from '@/lib/config';
 
 export interface PostFrontmatter {
   title: string;
@@ -10,6 +11,7 @@ export interface PostFrontmatter {
   featuredImage?: string | null;
   category?: string;
   locale: string;
+  public?: boolean;
 }
 
 export interface PostMdx {
@@ -18,6 +20,17 @@ export interface PostMdx {
   content: string;
 }
 
+export function isPostVisible(post: { frontmatter: { date: string; public?: boolean } }) {
+  // If explicitly marked as not public, hide in production
+  if (post.frontmatter.public === false && config.isProduction) {
+    return false;
+  }
+
+  const postDate = new Date(post.frontmatter.date);
+  const now = new Date();
+  return !(postDate > now && config.isProduction);
+}
+
 export async function getPostBySlug(slug: string, locale: string): Promise<PostMdx | null> {
   // Map translated slug to file slug
   const fileSlug = await mapSlugToFileSlug(slug, locale);
@@ -31,11 +44,17 @@ export async function getPostBySlug(slug: string, locale: string): Promise<PostM
   const fileContent = fs.readFileSync(filePath, 'utf8');
   const { data, content } = matter(fileContent);
 
-  return {
+  const postInfo = {
     slug: fileSlug,
     frontmatter: data as PostFrontmatter,
     content,
   };
+
+  if (!isPostVisible(postInfo)) {
+    return null;
+  }
+
+  return postInfo;
 }
 
 export async function getAllPosts(locale: string): Promise<PostMdx[]> {
@@ -55,6 +74,7 @@ export async function getAllPosts(locale: string): Promise<PostMdx[]> {
         content,
       };
     })
+    .filter(isPostVisible)
     .sort(
       (a, b) => new Date(b.frontmatter.date).getTime() - new Date(a.frontmatter.date).getTime(),
     );
@@ -78,6 +98,7 @@ export async function getAllPostsMetadata(locale: string): Promise<Partial<PostM
         frontmatter: data as PostFrontmatter,
       };
     })
+    .filter(isPostVisible)
     .sort(
       (a, b) =>
         new Date(b.frontmatter.date as string).getTime() -