From 39cfb7234cef8a95b3912d4c1f14627435d1110f Mon Sep 17 00:00:00 2001
From: enricobuehler <buehler@unom.io>
Date: Fri, 7 Aug 2026 10:11:02 +0200
Subject: [PATCH] fix(ci/docker): a cache-hit builders job stops failing on a
 login it never uses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The LAN-registry docker login only serves the Push step (Reconcile and
Tag-for-release authenticate via curl -u), but it ran unguarded — so a
hit=true leg landing on a host with a misconfigured docker daemon failed at
login with nothing to push (run 16044/16013 f44 leg). Gate it like Build/Push.
---
 .gitea/workflows/docker.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
index 8cb826d6..003f4491 100644
--- a/.gitea/workflows/docker.yml
+++ b/.gitea/workflows/docker.yml
@@ -148,7 +148,12 @@ jobs:
             -t "$CI_REGISTRY_PUSH/${{ matrix.image }}:latest" \
             ci
 
+      # Gated like Build/Push: only the docker CLI needs this login (Reconcile and Tag-for-release
+      # authenticate via curl -u), so a cache-hit job with nothing to push must not be able to fail
+      # on a login it never uses — proven on run 16013, where a host with a misconfigured daemon
+      # failed exactly here on a hit=true leg.
       - name: Log in to the LAN registry
+        if: steps.exists.outputs.hit == 'false'
         run: |
           echo "$CI_REGISTRY_PASSWORD" | docker login "$CI_REGISTRY_PUSH" -u ci --password-stdin
         env:
@@ -236,7 +241,9 @@ jobs:
             -t "$CI_REGISTRY_PUSH/$IMAGE:latest" \
             .
 
+      # Same gate as the builders job above: the login only serves Push.
       - name: Log in to the LAN registry
+        if: steps.exists.outputs.hit == 'false'
         run: |
           echo "$CI_REGISTRY_PASSWORD" | docker login "$CI_REGISTRY_PUSH" -u ci --password-stdin
         env: