.forgejo/workflows/build-push.yml

@@ -110,12 +110,48 @@ jobs:
 
       - name: Log in to the Forgejo registry
         if: steps.image.outputs.changed == 'true'
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           # NOT secrets.GITHUB_TOKEN -- Forgejo's per-job auto-injected token can
           # never push to the container registry (a known Forgejo limitation,
           # independent of any permission setting). Needs a manually provisioned
           # PAT with write:package scope, stored as REGISTRY_TOKEN.
-          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "${{ steps.image.outputs.host }}" \
+          #
+          # WHITESPACE IS THE FAILURE THIS GUARDS AGAINST, and it is a nasty one.
+          # `docker login --password-stdin` strips exactly ONE trailing newline.
+          # `echo "$T"` adds one. So a secret pasted WITH a trailing newline --
+          # which is what happens if you copy from a terminal or an editor that
+          # ends files with one -- arrives as "<token>\n" and the registry answers
+          #
+          #     Error response from daemon: Get "https://.../v2/": denied:
+          #
+          # with no further detail. That is indistinguishable from a revoked or
+          # wrong token, and it cost an afternoon on 2026-08-01 chasing a
+          # credential that was in fact valid. Strip first, echo never.
+          #
+          # The token also goes through the ENVIRONMENT rather than being
+          # interpolated into the script text. `${{ }}` is substituted before bash
+          # parses the line, so a value containing a quote or newline would change
+          # the shape of the command itself rather than just its arguments.
+          tok=$(printf '%s' "$REGISTRY_TOKEN" | tr -d ' \t\r\n')
+          if [ -z "$tok" ]; then
+            echo "::error::REGISTRY_TOKEN is empty or unset. Set it at" \
+                 "Settings -> Actions -> Secrets on this repository."
+            exit 1
+          fi
+          # Shape check is a WARNING, not a failure: a hard assertion on the token
+          # format would block every build the day Forgejo changes it. But saying
+          # so up front turns the registry's opaque "denied:" into a diagnosis.
+          # Length and character class only -- the value is never printed.
+          case "$tok" in
+            *[!0-9a-f]*) echo "::warning::REGISTRY_TOKEN contains characters outside" \
+                              "[0-9a-f]; a Forgejo PAT is 40 hex characters. If the" \
+                              "login below fails, re-paste the secret." ;;
+          esac
+          [ "${#tok}" -eq 40 ] || echo "::warning::REGISTRY_TOKEN is ${#tok} characters," \
+            "expected 40. If the login below fails, re-paste the secret."
+          printf '%s' "$tok" | docker login "${{ steps.image.outputs.host }}" \
             --username admin_emi --password-stdin
 
       - name: Build