From 354b785863a475c42122be9fdb2dae58c122cbc5 Mon Sep 17 00:00:00 2001
From: eezd <eezd@outlook.com>
Date: Tue, 27 Oct 2026 20:23:37 +0800
Subject: [PATCH] fix(ci): secure existing Docker authentication directories

---
 .gitea/workflows/ci.yml                | 6 ++++--
 .gitea/workflows/deploy-production.yml | 3 ++-
 .gitea/workflows/release.yml           | 3 ++-
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 1cf942d..cc49ecc 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -95,7 +95,8 @@ jobs:
           GITEA_RELEASE_TOKEN: ${{ secrets.RAWMARK_GITEA_TOKEN }}
         run: |
           set -eu
-          mkdir -m 700 "$DOCKER_CONFIG"
+          mkdir -p "$DOCKER_CONFIG"
+          chmod 700 "$DOCKER_CONFIG"
           python3 scripts/release.py promote-development "$TEMP_IMAGE"
       - name: Clean only this attempt's resources and credentials
         if: always()
@@ -131,7 +132,8 @@ jobs:
       - name: Deploy only the independent development instance
         run: |
           set -eu
-          mkdir -m 700 "$DOCKER_CONFIG"
+          mkdir -p "$DOCKER_CONFIG"
+          chmod 700 "$DOCKER_CONFIG"
           printf '%s' "$GITEA_RELEASE_TOKEN" | docker login git.134333.xyz --username eezd --password-stdin
           python3 scripts/deploy.py development --directory /docker/main/rawmark-dev \
             --image "$DEPLOY_IMAGE" --commit "$DEPLOY_COMMIT" --version "$DEPLOY_VERSION" \
diff --git a/.gitea/workflows/deploy-production.yml b/.gitea/workflows/deploy-production.yml
index bc8ed1c..129491c 100644
--- a/.gitea/workflows/deploy-production.yml
+++ b/.gitea/workflows/deploy-production.yml
@@ -41,7 +41,8 @@ jobs:
       - name: Verify completed release, back up and deploy only RawMark
         run: |
           set -eu
-          mkdir -m 700 "$DOCKER_CONFIG"
+          mkdir -p "$DOCKER_CONFIG"
+          chmod 700 "$DOCKER_CONFIG"
           python3 scripts/deploy.py production --directory /docker/main/rawmark \
             --version "$RELEASE_VERSION" --client-container "$(hostname)"
       - name: Remove job configuration
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index daf1219..2ad251a 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -142,7 +142,8 @@ jobs:
       - name: Publish the original checked artifacts to both services
         run: |
           set -eu
-          mkdir -m 700 "$DOCKER_CONFIG"
+          mkdir -p "$DOCKER_CONFIG"
+          chmod 700 "$DOCKER_CONFIG"
           python3 scripts/release.py publish
       - name: Clean only this attempt's test resources and credentials
         if: always()