Docker credential helper on the runner may interfere with login.
Write base64 credentials to ~/.docker/config.json directly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Multiline shell continuation in YAML was causing literal \n in the
command. Single-line pipe also avoids the CLI password warning.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Runs gitleaks detect with full history before the build job.
Both test and secrets jobs must pass to gate image push.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
python:3.13-slim lacks node, which actions/checkout@v4 requires.
Run test job on bare runner with setup-python instead.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Bake source into the image (COPY src/) so production containers
run without volume mounts. CI pipeline runs ruff + pytest then
builds and pushes harbor.mymx.me/s5p/s5p:latest on push to main.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
