From ff3a3a71e51b178f1b8dfcb72bd5f61e01202878 Mon Sep 17 00:00:00 2001
From: Shaun Campbell <shaun@campbellwireless.net>
Date: Tue, 15 Sep 2026 20:13:04 -0400
Subject: [PATCH] fix(ci): authenticate private module builds

---
 .gitea/workflows/main-image.yml | 2 ++
 Dockerfile                      | 9 ++++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/main-image.yml b/.gitea/workflows/main-image.yml
index 7bfdd35..2322502 100644
--- a/.gitea/workflows/main-image.yml
+++ b/.gitea/workflows/main-image.yml
@@ -52,6 +52,8 @@ jobs:
           file: ./Dockerfile
           push: true
           platforms: linux/amd64,linux/arm64
+          secrets: |
+            gitea_credentials=${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}
           tags: |
             ${{ env.REGISTRY_HOST }}/${{ env.IMAGE_NAME }}:latest
             ${{ env.REGISTRY_HOST }}/${{ env.IMAGE_NAME }}:${{ steps.image.outputs.sha_short }}
diff --git a/Dockerfile b/Dockerfile
index 40fc0d8..6b92122 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,13 @@
+# syntax=docker/dockerfile:1.7
 FROM golang:1.24-alpine AS build
 WORKDIR /src
-COPY go.mod ./
+RUN apk add --no-cache git
+COPY go.mod go.sum ./
+RUN --mount=type=secret,id=gitea_credentials \
+    credentials="$(cat /run/secrets/gitea_credentials)" && \
+    git config --global url."https://${credentials}@cloud.campbellwireless.net/git/".insteadOf "https://cloud.campbellwireless.net/git/" && \
+    GOPRIVATE=cloud.campbellwireless.net go mod download && \
+    git config --global --unset-all url."https://${credentials}@cloud.campbellwireless.net/git/".insteadOf
 COPY cmd ./cmd
 COPY internal ./internal
 RUN CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o /pawsql ./cmd/pawsql