From b0066c9ea644fd1fc2ecbd61889355de057305cc Mon Sep 17 00:00:00 2001
From: max <maxi2003.eibl@gmail.com>
Date: Sat, 26 Sep 2026 18:57:06 +0200
Subject: [PATCH] security(runner): remove plaintext token fallbacks, untrack
 .env, and enforce secret-only authentication

---
 .gitea/workflows/build-runner.yml | 4 ++--
 .gitignore                        | 3 +++
 runner/.env                       | 8 --------
 runner/docker-compose.yml         | 2 +-
 4 files changed, 6 insertions(+), 11 deletions(-)
 delete mode 100644 runner/.env

diff --git a/.gitea/workflows/build-runner.yml b/.gitea/workflows/build-runner.yml
index a5717d2..fb0c45f 100644
--- a/.gitea/workflows/build-runner.yml
+++ b/.gitea/workflows/build-runner.yml
@@ -27,8 +27,8 @@ jobs:
       - name: Log in to Gitea Container Registry
         run: |
           REGISTRY="gitea.eibl.tech"
-          USER="${{ secrets.PACKAGESUSER || secrets.GITEAUSER || secrets.packagesuser || 'me0nline' }}"
-          PASS="${{ secrets.GITEATOKEN || secrets.PACKAGESTOKEN || secrets.packagestoken || 'f64c72025024b0628479b889d871eb764d812951' }}"
+          USER="${{ secrets.GITEAUSER || secrets.PACKAGESUSER || github.actor }}"
+          PASS="${{ secrets.GITEATOKEN || secrets.PACKAGESTOKEN || secrets.TAG_TOKEN || github.token }}"
           echo "Logging in to ${REGISTRY} as ${USER}..."
           echo "${PASS}" | docker login "${REGISTRY}" -u "${USER}" --password-stdin
 
diff --git a/.gitignore b/.gitignore
index ca7a19c..05ef474 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,6 +29,9 @@ server_config.json
 client_config.json
 test_*.json
 test_*.db
+.env
+*.env
+runner/.env
 
 # IDE & OS files
 .vscode/
diff --git a/runner/.env b/runner/.env
deleted file mode 100644
index 07561a9..0000000
--- a/runner/.env
+++ /dev/null
@@ -1,8 +0,0 @@
-# Gitea Instance URL
-GITEA_INSTANCE_URL=https://gitea.eibl.tech
-
-# Gitea Runner Registration Token
-GITEA_RUNNER_REGISTRATION_TOKEN=MGynktVmt75MWfqRjahWLKsLKvOlrXDQZH5Wsn2p
-
-# Runner Configuration
-GITEA_RUNNER_NAME=logar-build-runner
diff --git a/runner/docker-compose.yml b/runner/docker-compose.yml
index 241bfad..7b3d37a 100644
--- a/runner/docker-compose.yml
+++ b/runner/docker-compose.yml
@@ -9,7 +9,7 @@ services:
       - .env
     environment:
       - GITEA_INSTANCE_URL=${GITEA_INSTANCE_URL:-https://gitea.eibl.tech}
-      - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN:-MGynktVmt75MWfqRjahWLKsLKvOlrXDQZH5Wsn2p}
+      - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN}
       - GITEA_RUNNER_NAME=${GITEA_RUNNER_NAME:-logar-build-runner}
       - GITEA_RUNNER_LABELS=logar:docker://gitea.eibl.tech/me0nline/logar-runner:latest
     volumes: