From ed439009d17840f18248b1363f0d910e92112271 Mon Sep 17 00:00:00 2001
From: Gustavo Ocanto <gustavoocanto@gmail.com>
Date: Mon, 27 Jul 2026 17:11:45 +0800
Subject: [PATCH 1/2] Use scoped token for VPS image pulls

---
 .github/workflows/deploy.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index e940d2ec..f38129b8 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -62,6 +62,8 @@ jobs:
     name: Deploy to VPS
     needs: build-and-push
     runs-on: ubuntu-24.04
+    permissions:
+      packages: read
 
     steps:
       - name: SSH and Pull Images on VPS
@@ -75,7 +77,7 @@ jobs:
             IMAGE_TAG=${{ needs.build-and-push.outputs.IMAGE_TAG }}
 
             echo "🔑 Logging into GitHub Container Registry ..."
-            echo ${{ secrets.DOCKER_REGISTRY_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+            echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
 
             echo "🚚 Pulling latest images with tag: $IMAGE_TAG"
             docker pull ghcr.io/oullin/oullin_api:$IMAGE_TAG

From c8616d7ee8e902ae0276cdb2df4891eb14ab31e7 Mon Sep 17 00:00:00 2001
From: Gustavo Ocanto <gustavoocanto@gmail.com>
Date: Mon, 27 Jul 2026 17:15:47 +0800
Subject: [PATCH 2/2] Harden remote registry authentication

---
 .github/workflows/deploy.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index f38129b8..eeb5250a 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -62,6 +62,7 @@ jobs:
     name: Deploy to VPS
     needs: build-and-push
     runs-on: ubuntu-24.04
+    # GHCR pulls require package access; all other token permissions stay disabled.
     permissions:
       packages: read
 
@@ -72,12 +73,13 @@ jobs:
           host: ${{ secrets.VPS_HOST }}
           username: ${{ secrets.VPS_USERNAME }}
           key: ${{ secrets.VPS_SSH_KEY }}
+          envs: GITHUB_TOKEN,GITHUB_ACTOR
           script: |
             set -Eeuo pipefail
             IMAGE_TAG=${{ needs.build-and-push.outputs.IMAGE_TAG }}
 
             echo "🔑 Logging into GitHub Container Registry ..."
-            echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+            echo "$GITHUB_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
 
             echo "🚚 Pulling latest images with tag: $IMAGE_TAG"
             docker pull ghcr.io/oullin/oullin_api:$IMAGE_TAG
@@ -107,3 +109,6 @@ jobs:
             ./deployment
 
             echo "✅ Deployment completed!"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_ACTOR: ${{ github.actor }}