.gitea/workflows/werf-deploy-template.yml

@@ -55,6 +55,10 @@ on:
         required: true
       VAULT_SECRET_ID:
         required: true
+      # Optional: Docker/npm private registry token (passed as WERF_BUILD_ARG_NPM_TOKEN).
+      # Callers that build images needing @scope packages from Nexus should pass this.
+      NPM_TOKEN:
+        required: false
 
 env:
   vault_main_base_path: dev/wilix/main/data/ci
@@ -117,6 +121,36 @@ jobs:
         if: ${{ inputs.werf_debug }}
         run: echo "WERF_LOG_DEBUG=true" >> "$GITHUB_ENV"
 
+      # Prefer Gitea secret; fall back to Vault project CI secret (same base path as werf key).
+      - id: import-npm-token
+        name: Get NPM_TOKEN from vault (fallback)
+        continue-on-error: true
+        uses: https://github.com/hashicorp/vault-action@v2
+        with:
+          url: https://vault.wilix.dev
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets: |
+            ${{ inputs.vault_secrets_base_path }} NPM_TOKEN | VAULT_NPM_TOKEN ;
+
+      - name: Resolve NPM_TOKEN for Docker build-args
+        id: resolve-npm-token
+        run: |
+          TOKEN="${{ secrets.NPM_TOKEN }}"
+          if [ -z "$TOKEN" ]; then
+            TOKEN="${{ steps.import-npm-token.outputs.VAULT_NPM_TOKEN }}"
+          fi
+          if [ -z "$TOKEN" ]; then
+            echo "NPM_TOKEN is empty. Set Gitea Actions secret NPM_TOKEN or Vault key" >&2
+            echo "  ${{ inputs.vault_secrets_base_path }} → NPM_TOKEN" >&2
+            exit 1
+          fi
+          # Mask + export for werf (WERF_BUILD_ARG_* → docker --build-arg)
+          echo "::add-mask::$TOKEN"
+          echo "NPM_TOKEN=$TOKEN" >> "$GITHUB_ENV"
+          echo "WERF_BUILD_ARG_NPM_TOKEN=$TOKEN" >> "$GITHUB_ENV"
+
       - name: Deploy
         run: werf converge
         env: