From 2756901fd1aec5e6725069ea9e5d5bacb9c12878 Mon Sep 17 00:00:00 2001
From: "dmitry.aloyan" <dmitry.aloyan@wilix.org>
Date: Thu, 6 Aug 2026 12:22:00 +0300
Subject: [PATCH] fix(werf-deploy): pass NPM_TOKEN into Docker build-args

Reusable workflow callers set env/secrets that never reached `werf
converge`. Accept optional NPM_TOKEN, fall back to Vault, export
WERF_BUILD_ARG_NPM_TOKEN before converge.
---
 .gitea/workflows/werf-deploy-template.yml | 34 +++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/.gitea/workflows/werf-deploy-template.yml b/.gitea/workflows/werf-deploy-template.yml
index 3a8509d..93b1816 100644
--- a/.gitea/workflows/werf-deploy-template.yml
+++ b/.gitea/workflows/werf-deploy-template.yml
@@ -55,6 +55,10 @@ on:
         required: true
       VAULT_SECRET_ID:
         required: true
+      # Optional: Docker/npm private registry token (passed as WERF_BUILD_ARG_NPM_TOKEN).
+      # Callers that build images needing @scope packages from Nexus should pass this.
+      NPM_TOKEN:
+        required: false
 
 env:
   vault_main_base_path: dev/wilix/main/data/ci
@@ -117,6 +121,36 @@ jobs:
         if: ${{ inputs.werf_debug }}
         run: echo "WERF_LOG_DEBUG=true" >> "$GITHUB_ENV"
 
+      # Prefer Gitea secret; fall back to Vault project CI secret (same base path as werf key).
+      - id: import-npm-token
+        name: Get NPM_TOKEN from vault (fallback)
+        continue-on-error: true
+        uses: https://github.com/hashicorp/vault-action@v2
+        with:
+          url: https://vault.wilix.dev
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets: |
+            ${{ inputs.vault_secrets_base_path }} NPM_TOKEN | VAULT_NPM_TOKEN ;
+
+      - name: Resolve NPM_TOKEN for Docker build-args
+        id: resolve-npm-token
+        run: |
+          TOKEN="${{ secrets.NPM_TOKEN }}"
+          if [ -z "$TOKEN" ]; then
+            TOKEN="${{ steps.import-npm-token.outputs.VAULT_NPM_TOKEN }}"
+          fi
+          if [ -z "$TOKEN" ]; then
+            echo "NPM_TOKEN is empty. Set Gitea Actions secret NPM_TOKEN or Vault key" >&2
+            echo "  ${{ inputs.vault_secrets_base_path }} → NPM_TOKEN" >&2
+            exit 1
+          fi
+          # Mask + export for werf (WERF_BUILD_ARG_* → docker --build-arg)
+          echo "::add-mask::$TOKEN"
+          echo "NPM_TOKEN=$TOKEN" >> "$GITHUB_ENV"
+          echo "WERF_BUILD_ARG_NPM_TOKEN=$TOKEN" >> "$GITHUB_ENV"
+
       - name: Deploy
         run: werf converge
         env:
-- 
2.52.0