From 522805c82652cfaaa31dd999906c48cd32e8d6e1 Mon Sep 17 00:00:00 2001
From: Lucas Rayan <lucas.guerra@pop-pe.rnp.br>
Date: Sun, 1 Nov 2026 21:46:19 -0300
Subject: [PATCH] =?UTF-8?q?ci:=20login=20no=20registro=20s=C3=B3=20antes?=
 =?UTF-8?q?=20de=20publicar?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Build, Trivy e smoke test não precisam de credencial.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .gitea/workflows/ci.yml | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index f31f05d..c070bbb 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -78,13 +78,6 @@ jobs:
       - id: plano
         run: scripts/plano-imagem.sh "$REGISTRY" "${{ gitea.repository }}" >> "$GITHUB_OUTPUT"
 
-      - if: ${{ steps.plano.outputs.reuse != 'true' }}
-        uses: docker/login-action@v4
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ gitea.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
-
       # `docker build` simples, no daemon persistente do runner: as camadas e o
       # cache mount do npm sobrevivem entre execuções. Um buildx criaria um
       # BuildKit novo, e vazio, a cada job.
@@ -109,6 +102,14 @@ jobs:
           docker rm -f pss-ci >/dev/null
           exit "$status"
 
+      # O login fica por último: build, Trivy e smoke não precisam de credencial.
+      - if: ${{ steps.plano.outputs.reuse != 'true' }}
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
       # Passou em tudo: publica a mesma imagem que foi testada, sem reconstruir.
       - name: Publica inputs-<hash>
         if: ${{ steps.plano.outputs.reuse != 'true' }}