From dd07ca439514d4b7452791b92cde378c99bfbba0 Mon Sep 17 00:00:00 2001
From: Jacob Hagstedt <jacob.hagstedt@gmail.com>
Date: Mon, 19 Oct 2026 20:06:47 +0200
Subject: [PATCH] Gitea workflow: temporary secret diagnostic step

Prints the lengths of secrets.kvitt_cicd, secrets.KVITT_CICD, the control
secrets.babymonitor_cicd, secrets.GITEA_TOKEN and github.token, plus the
repository, owner, actor, event, ref and server URL, before the registry
login. Values are never printed. Remove once the empty-secret cause is known.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
---
 .gitea/workflows/build-images.yaml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/.gitea/workflows/build-images.yaml b/.gitea/workflows/build-images.yaml
index 9cd6806..9546197 100644
--- a/.gitea/workflows/build-images.yaml
+++ b/.gitea/workflows/build-images.yaml
@@ -44,6 +44,25 @@ jobs:
     steps:
       - name: Install Git and Docker CLI
         run: apk add --no-cache git docker-cli docker-cli-buildx
+      # TEMPORARY (D-120 follow-up): remove this step once the cause of the empty `kvitt_cicd` secret is known.
+      # Prints only lengths (0 = absent or empty) and non-secret context values, never a secret value.
+      # Gitea stores secret names upper-cased and the expression lookup is case-insensitive; the upper-case line
+      # tests that on this runner. babymonitor_cicd is the owner's known-working user-level secret (control).
+      # GITEA_TOKEN and github.token are the job's automatic token.
+      - name: Diagnose secrets (temporary, D-120 follow-up)
+        run: |
+          A='${{ secrets.kvitt_cicd }}'; printf 'secrets.kvitt_cicd length: %s\n' "${#A}"
+          A='${{ secrets.KVITT_CICD }}'; printf 'secrets.KVITT_CICD length: %s\n' "${#A}"
+          A='${{ secrets.babymonitor_cicd }}'; printf 'secrets.babymonitor_cicd length: %s\n' "${#A}"
+          A='${{ secrets.GITEA_TOKEN }}'; printf 'secrets.GITEA_TOKEN length: %s\n' "${#A}"
+          A='${{ github.token }}'; printf 'github.token length: %s\n' "${#A}"
+          unset A
+          printf 'github.repository: %s\n' '${{ github.repository }}'
+          printf 'github.repository_owner: %s\n' '${{ github.repository_owner }}'
+          printf 'github.actor: %s\n' '${{ github.actor }}'
+          printf 'github.event_name: %s\n' '${{ github.event_name }}'
+          printf 'github.ref: %s\n' '${{ github.ref }}'
+          printf 'github.server_url: %s\n' '${{ github.server_url }}'
       - name: Log in to Gitea Container Registry
         # The owner's proven form: the secret interpolated into the run line (act_runner masks it in the log).
         # The env-based form (env: REGISTRY_TOKEN: ${{ secrets.kvitt_cicd }}) came through empty on act_runner 0.6.1.