From d6efabd96fe0492b13bd09202a354d801b4d0ae2f3ecff01b608abbd3d5d70ff Mon Sep 17 00:00:00 2001
From: "CTO (Paperclip)" <cto@basicstack.de>
Date: Sun, 25 Oct 2026 20:17:41 +0000
Subject: [PATCH] ci(images): pass Harbor secrets as env vars so robot `$` is
 not expanded (DEV-617)

Harbor robot usernames are of the form `robot$basicstack+forgejo-ci`.
Forgejo Actions substitutes `${{ secrets.HARBOR_USERNAME }}` into the
`run:` script before bash runs it, so `set -u` sees the resulting
`robot$basicstack+forgejo-ci` and dies with "basicstack: parameter
not set" trying to expand `$basicstack`. Pass the Harbor credentials
as env vars on the step; bash then reads them from the environment as
plain strings instead of parsing them for parameter expansion.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 .forgejo/workflows/build-images.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows/build-images.yml b/.forgejo/workflows/build-images.yml
index 7635979..38fa582 100644
--- a/.forgejo/workflows/build-images.yml
+++ b/.forgejo/workflows/build-images.yml
@@ -82,10 +82,18 @@ jobs:
 
       - name: Login to Harbor (push jobs only)
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        # Harbor robot usernames contain `$` (e.g. `robot$basicstack+ci`),
+        # so inlining `${{ secrets.HARBOR_USERNAME }}` directly in the
+        # `run:` script makes bash expand `$basicstack` (and die under
+        # `set -u`). Pass the secrets as env vars so the shell only sees
+        # them as plain strings.
+        env:
+          HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
+          HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}
         run: |
           set -eu
-          echo "${{ secrets.HARBOR_PASSWORD }}" | \
-            docker login "${REGISTRY}" --username "${{ secrets.HARBOR_USERNAME }}" --password-stdin
+          echo "${HARBOR_PASSWORD}" | \
+            docker login "${REGISTRY}" --username "${HARBOR_USERNAME}" --password-stdin
 
       - name: Push image (main only)
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'