From 7d818d5e5109100080aac316008f737415fc5d81 Mon Sep 17 00:00:00 2001
From: Jesse_Chen <chen.yue@mevixaga.com>
Date: Wed, 5 Aug 2026 20:00:41 +0800
Subject: [PATCH] Keep registry auth through manifest capture

---
 .gitea/workflows/backend-quality-gate.yml        | 6 ++++--
 frontend/tests/staging-backend-workflows.test.ts | 7 +++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/backend-quality-gate.yml b/.gitea/workflows/backend-quality-gate.yml
index e8f757fa..d0f48038 100644
--- a/.gitea/workflows/backend-quality-gate.yml
+++ b/.gitea/workflows/backend-quality-gate.yml
@@ -244,8 +244,6 @@ jobs:
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
           set -euo pipefail
-          cleanup() { docker logout "$REGISTRY_HOST" >/dev/null 2>&1 || true; }
-          trap cleanup EXIT
           printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOST" --username "$REGISTRY_USERNAME" --password-stdin
           docker build -f deploy/railway-api.Dockerfile -t "$IMAGE_REPOSITORY:api-$GITEA_SHA" .
           docker build -f deploy/railway-web.Dockerfile -t "$IMAGE_REPOSITORY:web-$GITEA_SHA" .
@@ -277,3 +275,7 @@ jobs:
           path: artifacts/staging-images/manifest.env
           if-no-files-found: error
           retention-days: 30
+
+      - name: Logout ACR registry
+        if: always()
+        run: docker logout "$REGISTRY_HOST" >/dev/null 2>&1 || true
diff --git a/frontend/tests/staging-backend-workflows.test.ts b/frontend/tests/staging-backend-workflows.test.ts
index 361d85ad..60a7ded0 100644
--- a/frontend/tests/staging-backend-workflows.test.ts
+++ b/frontend/tests/staging-backend-workflows.test.ts
@@ -203,6 +203,13 @@ test("Gitea quality gate validates before publishing an immutable ACR manifest",
   assert.match(workflow, /node frontend\/scripts\/staging-image-manifest\.mjs/);
   assert.match(workflow, /uses: https:\/\/gitea\.com\/actions\/upload-artifact@v4/);
   assert.match(workflow, /name: staging-image-manifest-\$\{\{ gitea\.sha \}\}-\$\{\{ gitea\.run_attempt \}\}/);
+  assertOrder(workflow, [
+    "docker login",
+    "Record immutable linux-amd64 image manifest",
+    "Upload immutable staging image manifest",
+    "Logout ACR registry",
+  ]);
+  assert.match(workflow, /Logout ACR registry\n\s+if: always\(\)/);
   assert.match(workflow, /\[\[ "\$GITEA_RUN_ATTEMPT" =~ \^\[0-9\]\+\$ \]\]/);
   assert.doesNotMatch(workflow, /STAGING_SSH_PRIVATE_KEY|run-staging-deploy\.sh|curl[^\n]+STAGING_URL/);
   assert.doesNotMatch(workflow, /(?:^|:)latest$/m);