Merge pull request 'Keep ACR auth through immutable manifest capture' (#4) from codex/fix-gitea-manifest-auth-20260805 into main

.gitea/workflows/backend-quality-gate.yml

@@ -244,8 +244,6 @@ jobs:
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
           set -euo pipefail
-          cleanup() { docker logout "$REGISTRY_HOST" >/dev/null 2>&1 || true; }
-          trap cleanup EXIT
           printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOST" --username "$REGISTRY_USERNAME" --password-stdin
           docker build -f deploy/railway-api.Dockerfile -t "$IMAGE_REPOSITORY:api-$GITEA_SHA" .
           docker build -f deploy/railway-web.Dockerfile -t "$IMAGE_REPOSITORY:web-$GITEA_SHA" .
@@ -277,3 +275,7 @@ jobs:
           path: artifacts/staging-images/manifest.env
           if-no-files-found: error
           retention-days: 30
+
+      - name: Logout ACR registry
+        if: always()
+        run: docker logout "$REGISTRY_HOST" >/dev/null 2>&1 || true

frontend/tests/staging-backend-workflows.test.ts

@@ -203,6 +203,13 @@ test("Gitea quality gate validates before publishing an immutable ACR manifest",
   assert.match(workflow, /node frontend\/scripts\/staging-image-manifest\.mjs/);
   assert.match(workflow, /uses: https:\/\/gitea\.com\/actions\/upload-artifact@v4/);
   assert.match(workflow, /name: staging-image-manifest-\$\{\{ gitea\.sha \}\}-\$\{\{ gitea\.run_attempt \}\}/);
+  assertOrder(workflow, [
+    "docker login",
+    "Record immutable linux-amd64 image manifest",
+    "Upload immutable staging image manifest",
+    "Logout ACR registry",
+  ]);
+  assert.match(workflow, /Logout ACR registry\n\s+if: always\(\)/);
   assert.match(workflow, /\[\[ "\$GITEA_RUN_ATTEMPT" =~ \^\[0-9\]\+\$ \]\]/);
   assert.doesNotMatch(workflow, /STAGING_SSH_PRIVATE_KEY|run-staging-deploy\.sh|curl[^\n]+STAGING_URL/);
   assert.doesNotMatch(workflow, /(?:^|:)latest$/m);