From 195c1df750c02ca95a6505041bc4644dfb1064b3 Mon Sep 17 00:00:00 2001
From: Marc Mintel <marc@mintel.me>
Date: Sun, 8 Feb 2026 14:36:47 +0100
Subject: [PATCH] fix: use mount secret for NPM_TOKEN in Dockerfile

---
 Dockerfile | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 02153b0..a753ea7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -29,8 +29,10 @@ RUN mkdir -p /pnpm/store
 COPY pnpm-lock.yaml pnpm-workspace.yaml package.json .npmrc ./
 COPY apps/web/package.json ./apps/web/package.json
 
-# Install dependencies with cache mount
+# Install dependencies with cache mount and NPM_TOKEN secret
 RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
+    --mount=type=secret,id=NPM_TOKEN \
+    export NPM_TOKEN=$(cat /run/secrets/NPM_TOKEN) && \
     pnpm install --frozen-lockfile
 
 # Copy source