From 8be21d8e87a8215a5c784a49dbc59bd3313ba0fe Mon Sep 17 00:00:00 2001
From: MichaelFisher1997 <contact@michaelfisher.tech>
Date: Tue, 5 May 2026 02:25:52 +0000
Subject: [PATCH] fix: validate microservices image access early

---
 .gitea/workflows/deploy.yml | 38 +++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 65c6d45..782aeb3 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -36,6 +36,44 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Validate MicroServices GHCR image access
+        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+        env:
+          GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
+          GHCR_READ_TOKEN: ${{ secrets.GHCR_READ_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          if [ -z "${GHCR_USERNAME}" ] || [ -z "${GHCR_READ_TOKEN}" ]; then
+            echo "GHCR_USERNAME and GHCR_READ_TOKEN are required for private MicroServices image pulls" >&2
+            exit 1
+          fi
+
+          check_image() {
+            local repository="$1"
+            local tag="$2"
+            local token
+            local status
+
+            token="$(curl -fsSL \
+              -u "${GHCR_USERNAME}:${GHCR_READ_TOKEN}" \
+              "https://ghcr.io/token?service=ghcr.io&scope=repository:${repository}:pull" \
+              | python3 -c 'import json,sys; print(json.load(sys.stdin)["token"])')"
+
+            status="$(curl -fsS -o /dev/null -w '%{http_code}' \
+              -H "Authorization: Bearer ${token}" \
+              -H 'Accept: application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json' \
+              "https://ghcr.io/v2/${repository}/manifests/${tag}" || true)"
+
+            if [ "${status}" != "200" ]; then
+              echo "Cannot pull ghcr.io/${repository}:${tag}; GHCR returned HTTP ${status}. Check package visibility and GHCR_READ_TOKEN read:packages access." >&2
+              exit 1
+            fi
+          }
+
+          check_image openstaticfish/microservices/site-analyzer main
+          check_image openstaticfish/microservices/scraper main
+
       - name: Setup Terraform
         uses: hashicorp/setup-terraform@v3
         with: