From 418f4e063106bc17c6182b357739dd3664e12ccc Mon Sep 17 00:00:00 2001 From: Emi Griffith Date: Wed, 22 Jul 2026 15:27:30 -0700 Subject: [PATCH] deploy.sh: make registry login conditional on REGISTRY_TOKEN The CI/SSH deploy paths (deploy.yml/deploy-prod.yml over SSH, deploy-dev on the LAN runner) don't pass REGISTRY_TOKEN and rely on the host already being docker-logged-in; an unconditional login with an empty token aborts deploy.sh under set -e. Skip the login when no token is set and trust the host cred; pull still fails loudly on a real auth problem. --- deploy/deploy.sh | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/deploy/deploy.sh b/deploy/deploy.sh index 574485e..6580ec3 100755 --- a/deploy/deploy.sh +++ b/deploy/deploy.sh @@ -141,8 +141,18 @@ case "$SERVICE" in all) TARGETS=(backend frontend) ;; esac -echo "==> Logging in to the registry ($REGISTRY_HOST)" -echo "$REGISTRY_TOKEN" | docker login "$REGISTRY_HOST" --username emi --password-stdin +# Login only when a token is supplied. The SSH/CI deploy paths (deploy.yml, +# deploy-prod.yml, deploy-dev on the LAN runner) don't pass REGISTRY_TOKEN -- +# the host is already `docker login`ed to the registry (persistent cred in +# ~/.docker/config.json), so an unconditional login with an empty token would +# abort the deploy under `set -e`. Use the token if present, else trust the +# host's existing cred; a genuine auth problem then fails loudly at `pull`. +if [ -n "${REGISTRY_TOKEN:-}" ]; then + echo "==> Logging in to the registry ($REGISTRY_HOST)" + echo "$REGISTRY_TOKEN" | docker login "$REGISTRY_HOST" --username emi --password-stdin +else + echo "==> No REGISTRY_TOKEN in env; relying on the host's existing docker login to $REGISTRY_HOST" +fi echo "==> Pulling images (backend=$BACKEND_IMAGE_TAG frontend=$FRONTEND_IMAGE_TAG; rolling: ${TARGETS[*]})" # Retry: build-push.yml (triggered by the same push) has no ordering guarantee