From 1650744e890b6d3bc90e5e6ef52559ebd7bdab75 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Tue, 5 May 2026 14:31:50 -0500
Subject: [PATCH] chore(ci): source registry host from secrets.REGISTRY_URL

All three image build workflows previously hardcoded REGISTRY=codeberg.org
and only pulled USER/PASSWORD from secrets. Switching the URL to come from
the same secrets bag means a registry rotation only needs the
REGISTRY_URL / REGISTRY_USER / REGISTRY_PASSWORD secrets updated, not a
commit to every workflow file.
---
 .forgejo/workflows/build-base.yaml    | 19 +++++++------------
 .forgejo/workflows/build-grid-rs.yaml |  2 +-
 .forgejo/workflows/build.yaml         | 10 +++++-----
 3 files changed, 13 insertions(+), 18 deletions(-)

diff --git a/.forgejo/workflows/build-base.yaml b/.forgejo/workflows/build-base.yaml
index f66ab4d8..eb5eb343 100644
--- a/.forgejo/workflows/build-base.yaml
+++ b/.forgejo/workflows/build-base.yaml
@@ -22,13 +22,11 @@ on:
     - cron: '0 6 * * 0'
   workflow_dispatch:
 
-# Base image lives on Codeberg's container registry. The shared
-# REGISTRY_USER / REGISTRY_PASSWORD secrets are set to Codeberg
-# credentials; the registry URL is hardcoded here rather than read
-# from secrets.REGISTRY_URL so the workflow can't accidentally push
-# to a different registry if that secret drifts.
+# Base image lives on Codeberg's container registry. Registry host
+# and creds are sourced from the shared REGISTRY_URL / REGISTRY_USER
+# / REGISTRY_PASSWORD secrets.
 env:
-  REGISTRY: codeberg.org
+  REGISTRY: ${{ secrets.REGISTRY_URL }}
   IMAGE_NAME: gmcintire/prop-base
 
 concurrency:
@@ -97,12 +95,9 @@ jobs:
 
       - name: Log in to Codeberg container registry
         run: |
-          # Reuses the shared REGISTRY_USER / REGISTRY_PASSWORD
-          # Forgejo Actions secrets — already set with Codeberg
-          # credentials (token must have `write:package` scope).
-          # Login URL is the hardcoded env.REGISTRY rather than
-          # secrets.REGISTRY_URL so this workflow can't accidentally
-          # push to whatever registry the URL secret points at.
+          # Reuses the shared REGISTRY_URL / REGISTRY_USER /
+          # REGISTRY_PASSWORD Forgejo Actions secrets (Codeberg
+          # token must have `write:package` scope).
           attempt=1
           max_attempts=3
           while : ; do
diff --git a/.forgejo/workflows/build-grid-rs.yaml b/.forgejo/workflows/build-grid-rs.yaml
index a37c9a48..b487ccc9 100644
--- a/.forgejo/workflows/build-grid-rs.yaml
+++ b/.forgejo/workflows/build-grid-rs.yaml
@@ -12,7 +12,7 @@ on:
 
 # Hosted on Codeberg's container registry. Same setup as build.yaml.
 env:
-  REGISTRY: codeberg.org
+  REGISTRY: ${{ secrets.REGISTRY_URL }}
   IMAGE_NAME: gmcintire/prop-grid-rs
 
 concurrency:
diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index 16583775..fce33105 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -5,12 +5,12 @@ on:
     branches:
       - main
 
-# Hosted on Codeberg's container registry. The shared
-# REGISTRY_USER / REGISTRY_PASSWORD secrets carry the Codeberg
-# token; URL is hardcoded so a wrong/missing secrets.REGISTRY_URL
-# can't push to the wrong registry.
+# Hosted on Codeberg's container registry. Registry host + creds
+# are sourced from the shared REGISTRY_URL / REGISTRY_USER /
+# REGISTRY_PASSWORD secrets so the registry can be rotated without
+# editing every workflow file.
 env:
-  REGISTRY: codeberg.org
+  REGISTRY: ${{ secrets.REGISTRY_URL }}
   IMAGE_NAME: gmcintire/prop
 
 concurrency: