From f12fa03f1c8f0a030b255e225346a4b8001e9b5b Mon Sep 17 00:00:00 2001
From: Kawa <us.fame.sq@gmail.com>
Date: Fri, 28 Aug 2026 16:00:26 +0200
Subject: [PATCH] ci: build and push the image with plain docker

Drops docker/login-action, docker/setup-buildx-action and
docker/build-push-action. This is a single-platform build of one
Dockerfile, which dockerd's integrated BuildKit already does; the only
thing the actions added was buildx's docker-container driver, and
standing that up means pulling moby/buildkit and handing it the socket
for no gain.

docker login reads the token from stdin rather than -p, and a logout step
runs with always() so a failed build does not leave credentials in
~/.docker/config.json on this persistent runner.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .gitea/workflows/release.yml | 42 ++++++++++++++++++++++--------------
 1 file changed, 26 insertions(+), 16 deletions(-)

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 19bfc2d..c14f1dd 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -125,23 +125,33 @@ jobs:
           LC_ALL: en_US.UTF-8
         run: ./scripts/build-release.ps1 -Targets win,linux-appimage -Tag $env:TAG
 
-      - name: Log in to git.azuze.fr
-        uses: docker/login-action@v3
-        with:
-          registry: git.azuze.fr
-          username: ${{ secrets.BUILD_USER }}
-          password: ${{ secrets.BUILD_TOKEN }}
-
-      - uses: docker/setup-buildx-action@v3
-
+      # Plain docker rather than docker/login-action + setup-buildx-action +
+      # build-push-action. This is a single-platform build of one Dockerfile, which
+      # dockerd's own integrated BuildKit does; the actions' only added value here
+      # would be the docker-container driver, and standing that up means pulling
+      # moby/buildkit and mounting the socket into it for no gain.
+      #
+      # --password-stdin, never -p: an argument is visible in ps and in the daemon's
+      # process list for as long as the login runs.
       - name: Build and push image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          push: true
-          tags: |
-            ${{ env.IMAGE }}:latest
-            ${{ env.IMAGE }}:${{ steps.vars.outputs.tag }}
+        env:
+          TAG: ${{ steps.vars.outputs.tag }}
+          REGISTRY_USER: ${{ secrets.BUILD_USER }}
+          REGISTRY_TOKEN: ${{ secrets.BUILD_TOKEN }}
+        run: |
+          set -euo pipefail
+          printf '%s' "$REGISTRY_TOKEN" \
+            | docker login git.azuze.fr -u "$REGISTRY_USER" --password-stdin
+          docker build -t "$IMAGE:latest" -t "$IMAGE:$TAG" .
+          docker push "$IMAGE:latest"
+          docker push "$IMAGE:$TAG"
+
+      # This runner is a persistent host, so the credentials written by docker login
+      # would otherwise sit in ~/.docker/config.json between jobs. always(): a failed
+      # build is exactly when they must not be left behind.
+      - name: Log out of git.azuze.fr
+        if: always()
+        run: docker logout git.azuze.fr || true
 
       - name: Publish Gitea release
         env: