From 5ec5c41a0aaf2b54c16f30e7723b623c5e6d7236 Mon Sep 17 00:00:00 2001
From: Michael Schiemer <kontakt@michaelschiemer.de>
Date: Sat, 1 Nov 2025 22:16:23 +0100
Subject: [PATCH] fix(ci): improve image selection and registry handling in
 deployment workflow

- Add better image selection logic with fallback handling
- Support multiple registry logins for different image sources
- Improve error handling and image URL parsing
- Add proper argument escaping for SSH deployment script
---
 .gitea/workflows/build-image.yml | 110 +++++++++++++++++++++++--------
 1 file changed, 83 insertions(+), 27 deletions(-)

diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml
index 714a2e14..faf4603a 100644
--- a/.gitea/workflows/build-image.yml
+++ b/.gitea/workflows/build-image.yml
@@ -830,57 +830,113 @@ jobs:
           set -e
           
           DEPLOYMENT_HOST="${{ env.DEPLOYMENT_HOST }}"
-          REGISTRY="${{ env.REGISTRY }}"
+          REGISTRY_HOST="${{ env.REGISTRY }}"
           IMAGE_NAME="${{ env.IMAGE_NAME }}"
           BUILD_RESULT="${{ needs.build.result }}"
-          IMAGE_TAG="${{ needs.build.outputs.image_tag || 'latest' }}"
+          IMAGE_TAG_RAW="${{ needs.build.outputs.image_tag }}"
+          IMAGE_URL_RAW="${{ needs.build.outputs.image_url }}"
           
-          if [ "$BUILD_RESULT" != "success" ]; then
-            IMAGE_TAG="latest"
+          DEFAULT_IMAGE="${REGISTRY_HOST}/${IMAGE_NAME}:latest"
+          SELECTED_IMAGE=""
+          
+          if [ "$BUILD_RESULT" = "success" ] && [ -n "$IMAGE_URL_RAW" ] && [ "$IMAGE_URL_RAW" != "null" ]; then
+            SELECTED_IMAGE="$IMAGE_URL_RAW"
           fi
           
-          if [ -z "$IMAGE_TAG" ] || [ "$IMAGE_TAG" = "null" ]; then
-            IMAGE_TAG="latest"
+          if [ -z "$SELECTED_IMAGE" ]; then
+            if [ "$BUILD_RESULT" = "success" ] && [ -n "$IMAGE_TAG_RAW" ] && [ "$IMAGE_TAG_RAW" != "null" ]; then
+              SELECTED_IMAGE="${REGISTRY_HOST}/${IMAGE_NAME}:${IMAGE_TAG_RAW}"
+            else
+              SELECTED_IMAGE="$DEFAULT_IMAGE"
+            fi
+          fi
+          
+          if [ -z "$SELECTED_IMAGE" ]; then
+            SELECTED_IMAGE="$DEFAULT_IMAGE"
+          fi
+          
+          SELECTED_TAG="${SELECTED_IMAGE##*:}"
+          SELECTED_REPO="${SELECTED_IMAGE%:*}"
+          
+          if [ -z "$SELECTED_REPO" ] || [ "$SELECTED_REPO" = "$SELECTED_IMAGE" ]; then
+            FALLBACK_IMAGE="$DEFAULT_IMAGE"
+          else
+            FALLBACK_IMAGE="${SELECTED_REPO}:latest"
           fi
           
-          FULL_IMAGE="${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"
           STACK_PATH="~/deployment/stacks/staging"
           
           echo "🚀 Starting staging deployment..."
-          echo "   Image: ${FULL_IMAGE}"
-          echo "   Tag: ${IMAGE_TAG}"
+          echo "   Image: ${SELECTED_IMAGE}"
+          echo "   Tag: ${SELECTED_TAG}"
           echo "   Host: ${DEPLOYMENT_HOST}"
           echo "   Stack: ${STACK_PATH}"
           
+          FULL_IMAGE_ARG=$(printf '%q' "$SELECTED_IMAGE")
+          FALLBACK_IMAGE_ARG=$(printf '%q' "$FALLBACK_IMAGE")
+          IMAGE_NAME_ARG=$(printf '%q' "$IMAGE_NAME")
+          STACK_PATH_ARG=$(printf '%q' "$STACK_PATH")
+          REGISTRY_ARG=$(printf '%q' "$REGISTRY_HOST")
+          
           ssh -i ~/.ssh/production \
               -o StrictHostKeyChecking=no \
               -o UserKnownHostsFile=/dev/null \
-              deploy@${DEPLOYMENT_HOST} <<EOF
+              deploy@${DEPLOYMENT_HOST} "bash -s -- $FULL_IMAGE_ARG $FALLBACK_IMAGE_ARG $IMAGE_NAME_ARG $STACK_PATH_ARG $REGISTRY_ARG" <<'EOF'
             set -e
             
+            FULL_IMAGE="$1"
+            FALLBACK_IMAGE="$2"
+            IMAGE_NAME="$3"
+            STACK_PATH="$4"
+            REGISTRY="$5"
+            shift 5
+            
+            STACK_TARGET="${STACK_PATH:-~/deployment/stacks/staging}"
+            case "$STACK_TARGET" in
+              ~*) STACK_TARGET="${HOME}${STACK_TARGET#~}" ;;
+            esac
+            
             # Ensure staging stack directory exists
-            mkdir -p ${STACK_PATH}
-            cd ${STACK_PATH}
+            mkdir -p "${STACK_TARGET}"
+            cd "${STACK_TARGET}"
             
-            echo "🔐 Logging in to Docker registry..."
-            echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login ${REGISTRY} \
-              -u "${{ secrets.REGISTRY_USER }}" \
-              --password-stdin || echo "⚠️  Registry login failed, continuing..."
+            declare -a REGISTRY_TARGETS=()
+            if [ -n "${REGISTRY}" ]; then
+              REGISTRY_TARGETS+=("${REGISTRY}")
+            fi
+            for IMAGE_REF in "${FULL_IMAGE}" "${FALLBACK_IMAGE}"; do
+              if [ -n "${IMAGE_REF}" ]; then
+                HOST_PART="${IMAGE_REF%%/*}"
+                if [ -n "${HOST_PART}" ]; then
+                  if ! printf '%s\n' "${REGISTRY_TARGETS[@]}" | grep -qx "${HOST_PART}"; then
+                    REGISTRY_TARGETS+=("${HOST_PART}")
+                  fi
+                fi
+              fi
+            done
             
-            echo "📥 Pulling image ${FULL_IMAGE}..."
-            if ! docker pull ${FULL_IMAGE}; then
-              if [ "${IMAGE_TAG}" != "latest" ]; then
-                echo "⚠️  Failed to pull ${FULL_IMAGE}, falling back to :latest"
-                IMAGE_TAG="latest"
-                FULL_IMAGE="${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"
-                if docker pull ${FULL_IMAGE}; then
-                  echo "ℹ️ Using fallback image ${FULL_IMAGE}"
+            for TARGET in "${REGISTRY_TARGETS[@]}"; do
+              [ -z "${TARGET}" ] && continue
+              echo "🔐 Logging in to Docker registry ${TARGET}..."
+              echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${TARGET}" \
+                -u "${{ secrets.REGISTRY_USER }}" \
+                --password-stdin || echo "⚠️  Registry login failed for ${TARGET}, continuing..."
+            done
+            
+            DEPLOY_IMAGE="$FULL_IMAGE"
+            echo "📥 Pulling image ${DEPLOY_IMAGE}..."
+            if ! docker pull "${DEPLOY_IMAGE}"; then
+              if [ -n "${FALLBACK_IMAGE}" ] && [ "${DEPLOY_IMAGE}" != "${FALLBACK_IMAGE}" ]; then
+                echo "⚠️  Failed to pull ${DEPLOY_IMAGE}, attempting fallback ${FALLBACK_IMAGE}"
+                if docker pull "${FALLBACK_IMAGE}"; then
+                  DEPLOY_IMAGE="${FALLBACK_IMAGE}"
+                  echo "ℹ️ Using fallback image ${DEPLOY_IMAGE}"
                 else
-                  echo "❌ Failed to pull fallback image ${FULL_IMAGE}"
+                  echo "❌ Failed to pull fallback image ${FALLBACK_IMAGE}"
                   exit 1
                 fi
               else
-                echo "❌ Failed to pull image ${FULL_IMAGE}"
+                echo "❌ Failed to pull image ${DEPLOY_IMAGE}"
                 exit 1
               fi
             fi
@@ -896,7 +952,7 @@ jobs:
             
             # Update docker-compose.yml with new image tag
             echo "📝 Updating docker-compose.yml..."
-            sed -i "s|image:.*/${IMAGE_NAME}:.*|image: ${FULL_IMAGE}|g" docker-compose.yml
+            sed -i "s|image:.*/${IMAGE_NAME}:.*|image: ${DEPLOY_IMAGE}|g" docker-compose.yml
             
             echo "✅ Updated docker-compose.yml:"
             grep "image:" docker-compose.yml | head -5