.gitea/workflows/werf-deploy-template.yml

@@ -55,10 +55,6 @@ on:
         required: true
       VAULT_SECRET_ID:
         required: true
-      # Optional: Docker/npm private registry token (passed as WERF_BUILD_ARG_NPM_TOKEN).
-      # Callers that build images needing @scope packages from Nexus should pass this.
-      NPM_TOKEN:
-        required: false
 
 env:
   vault_main_base_path: dev/wilix/main/data/ci
@@ -121,36 +117,6 @@ jobs:
         if: ${{ inputs.werf_debug }}
         run: echo "WERF_LOG_DEBUG=true" >> "$GITHUB_ENV"
 
-      # Prefer Gitea secret; fall back to Vault project CI secret (same base path as werf key).
-      - id: import-npm-token
-        name: Get NPM_TOKEN from vault (fallback)
-        continue-on-error: true
-        uses: https://github.com/hashicorp/vault-action@v2
-        with:
-          url: https://vault.wilix.dev
-          method: approle
-          roleId: ${{ secrets.VAULT_ROLE_ID }}
-          secretId: ${{ secrets.VAULT_SECRET_ID }}
-          secrets: |
-            ${{ inputs.vault_secrets_base_path }} NPM_TOKEN | VAULT_NPM_TOKEN ;
-
-      - name: Resolve NPM_TOKEN for Docker build-args
-        id: resolve-npm-token
-        run: |
-          TOKEN="${{ secrets.NPM_TOKEN }}"
-          if [ -z "$TOKEN" ]; then
-            TOKEN="${{ steps.import-npm-token.outputs.VAULT_NPM_TOKEN }}"
-          fi
-          if [ -z "$TOKEN" ]; then
-            echo "NPM_TOKEN is empty. Set Gitea Actions secret NPM_TOKEN or Vault key" >&2
-            echo "  ${{ inputs.vault_secrets_base_path }} → NPM_TOKEN" >&2
-            exit 1
-          fi
-          # Mask + export for werf (WERF_BUILD_ARG_* → docker --build-arg)
-          echo "::add-mask::$TOKEN"
-          echo "NPM_TOKEN=$TOKEN" >> "$GITHUB_ENV"
-          echo "WERF_BUILD_ARG_NPM_TOKEN=$TOKEN" >> "$GITHUB_ENV"
-
       - name: Deploy
         run: werf converge
         env: