Pass registry credentials via env instead of script interpolation

Template interpolation embeds the secret in the generated script file; env indirection keeps it out of argv and off disk.
2026-06-12 12:21:19 -04:00
parent 12a62a91cf
commit 13e9e88e0e
1 changed files with 5 additions and 2 deletions
@@ -17,9 +17,12 @@ jobs:
      - uses: actions/checkout@v4

      - name: Log in to registry
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
-          echo "${{ secrets.REGISTRY_TOKEN }}" \
-            | docker login -u "${{ secrets.REGISTRY_USER }}" --password-stdin git.weaselab.dev
+          echo "$REGISTRY_TOKEN" \
+            | docker login -u "$REGISTRY_USER" --password-stdin git.weaselab.dev

      - name: Build and push image if changed
        run: |