From b1c06e3a2db1166819d53cf78110819c7d3a03f3 Mon Sep 17 00:00:00 2001
From: LovroG05 <lovro@govekar.net>
Date: Mon, 29 Jun 2026 14:05:01 +0200
Subject: [PATCH] fix: use docker login directly for Gitea basic auth, disable
 provenance

---
 .gitea/workflows/docker.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
index c7295a2..1ba5b29 100644
--- a/.gitea/workflows/docker.yml
+++ b/.gitea/workflows/docker.yml
@@ -43,13 +43,11 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      # docker/login-action uses OAuth token exchange which Gitea doesn't support.
+      # Use docker login directly for basic auth.
       - name: Log in to registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
+        run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login ${{ env.REGISTRY }} -u ${{ secrets.REGISTRY_USER }} --password-stdin
 
       - name: Build and push — standard
         uses: docker/build-push-action@v6
@@ -62,6 +60,7 @@ jobs:
           cache-from: type=gha,scope=standard
           cache-to: type=gha,mode=max,scope=standard
           platforms: linux/amd64,linux/arm64
+          provenance: false
 
       - name: Build and push — bundled (postgres included)
         uses: docker/build-push-action@v6
@@ -74,3 +73,4 @@ jobs:
           cache-from: type=gha,scope=bundled
           cache-to: type=gha,mode=max,scope=bundled
           platforms: linux/amd64,linux/arm64
+          provenance: false