From 2bc0d4d89ff2dabd212de8549cdfb0b5406e5830 Mon Sep 17 00:00:00 2001
From: Jaap-Jan de Wit | DodoTech <jaap-jan@dodotech.dev>
Date: Sat, 1 Aug 2026 16:51:12 +0200
Subject: [PATCH] Say which credential is missing instead of letting docker
 guess
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The registry secrets are reportedly not arriving, and the job could not have told anybody
which one or why. An unset secret is not an error anywhere upstream: ${{ }} renders a
missing value as an empty string, so docker gets --username "" and replies with something
about credentials — which reads as the registry rejecting a login rather than as a value
that never left the settings page.

Checked before use now, and reported by length rather than by value. Gitea masks known
secret values in logs, but a mask is only as good as the runner's bookkeeping, and a length
answers the only question actually being asked: did anything arrive at all. The message
names the page to look at, and names the neighbouring one too, since Actions Variables and
Actions Secrets sit next to each other and only one of them is readable through the secrets
context.

This does not fix the credentials. It converts a confusing failure into a specific one, so
the next run distinguishes "the secret is empty here" from "the registry refused these" —
two problems with nothing in common that currently look identical.

Verified by running the step's script with both variables set empty, which is the reported
symptom: it names both, points at the settings page and exits 1 before docker is called.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 28 +++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d62c247..a39c4c2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -485,7 +485,33 @@ jobs:
           REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
-          set -euo pipefail
+          set -eu
+
+          # Checked before use, because an unset secret is not an error anywhere upstream of
+          # here: ${{ }} renders a missing value as the empty string, so docker is handed
+          # --username "" and answers with something about credentials, which sends people
+          # to the registry to debug a value that never left the settings page.
+          #
+          # Reported by length, and never by value. Gitea masks known secret values in logs,
+          # but a mask is only as good as the runner's bookkeeping and a length answers the
+          # only question being asked: did anything arrive.
+          missing=""
+          [ -n "${REGISTRY_USERNAME:-}" ] || missing="$missing REGISTRY_USERNAME"
+          [ -n "${REGISTRY_PASSWORD:-}" ] || missing="$missing REGISTRY_PASSWORD"
+
+          if [ -n "$missing" ]; then
+            echo "Empty or unset:$missing" >&2
+            echo >&2
+            echo "Both come from repository secrets, which in Gitea are at" >&2
+            echo "  Settings -> Actions -> Secrets" >&2
+            echo "and are a different page from Settings -> Actions -> Variables. A value" >&2
+            echo "added as a variable is invisible to the secrets context and arrives here" >&2
+            echo "as an empty string, which is exactly what this message means." >&2
+            exit 1
+          fi
+
+          echo "username: ${#REGISTRY_USERNAME} characters; password: set"
+
           printf '%s' "$REGISTRY_PASSWORD" \
             | docker login registry-docker.dodotech.cloud \
                 --username "$REGISTRY_USERNAME" --password-stdin