From 38221c4baa26ad388ca89a44045d5002b89afff5 Mon Sep 17 00:00:00 2001
From: Benjamin Toby <devops@tben.me>
Date: Thu, 22 Oct 2026 13:58:59 +0100
Subject: [PATCH] Keep secrets out of the release matrix, where Actions rejects
 them

---
 .github/workflows/release.yml | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 867d660..ec3e3f0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,12 +24,8 @@ jobs:
       matrix:
         include:
           - registry: ghcr.io
-            login_username: ${{ github.actor }}
-            login_password: ${{ secrets.GITHUB_TOKEN }}
             soft: "false"
           - registry: git.tben.me
-            login_username: ${{ secrets.GITEA_USERNAME }}
-            login_password: ${{ secrets.GITEA_TOKEN }}
             soft: "true"
     continue-on-error: ${{ matrix.soft }}
     steps:
@@ -39,12 +35,21 @@ jobs:
 
       - uses: docker/setup-buildx-action@v3
 
-      - name: Log in to ${{ matrix.registry }}
+      - name: Log in to GHCR
+        if: matrix.registry == 'ghcr.io'
         uses: docker/login-action@v3
         with:
           registry: ${{ matrix.registry }}
-          username: ${{ matrix.login_username }}
-          password: ${{ matrix.login_password }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to Gitea
+        if: matrix.registry == 'git.tben.me'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ matrix.registry }}
+          username: ${{ secrets.GITEA_USERNAME }}
+          password: ${{ secrets.GITEA_TOKEN }}
 
       - name: Work out image tags
         id: tags