Take the registry hostname from a secret, not a variable

This repo is public and its Actions logs are readable anonymously: an
unauthenticated fetch of an old publish run's log returns the registry
hostname in plaintext. Gitea masks secret values in those logs; it does
not mask variables, so `vars.REGISTRY` would have kept publishing the
hostname on every run.

The guard moves off the job, because a job-level `if:` cannot read
`secrets` -- which is why it used `vars` in the first place. A first
step checks the secret and sets an output the publishing steps gate on,
so a fork without it still skips rather than fails.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TiPehVTCDGWgEBJ7H4G5VL

.gitea/workflows/publish.yml

@@ -8,17 +8,28 @@ on:
   pull_request:
 
 env:
-  # Set the REGISTRY repository variable to publish images. Without it this
-  # job is skipped, so forks don't fail on a registry they can't reach.
-  REGISTRY: ${{ vars.REGISTRY }}
+  # Set the REGISTRY secret to publish images; without it the publishing steps
+  # are skipped, so forks don't fail on a registry they can't reach.
+  #
+  # A secret rather than a variable: this repo is public and its Actions logs
+  # are readable anonymously, and Gitea masks secret values in those logs but
+  # not variable values.
+  REGISTRY: ${{ secrets.REGISTRY }}
   IMAGE: prologic/zs
   TAG: latest
 
 jobs:
   publish:
     runs-on: ubuntu-latest
-    if: ${{ vars.REGISTRY != '' }}
     steps:
+    - name: Check Publishing Is Configured
+      id: registry
+      run: |
+        if [ -n "$REGISTRY" ]; then
+          echo "enabled=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "REGISTRY secret is not set; skipping publish"
+        fi
     - name: Checkout Code
       uses: actions/checkout@v3
       with:
@@ -26,6 +37,7 @@ jobs:
     - name: Setup Docker Buildx
       uses: actions/setup-buildx@v2
     - name: Login to Registry
+      if: steps.registry.outputs.enabled == 'true'
       uses: actions/docker-login@v2
       with:
         registry: ${{ env.REGISTRY }}
@@ -40,6 +52,7 @@ jobs:
           echo "BUILD=$(git show -s --pretty=format:%cI)"
         } >> "$GITHUB_OUTPUT"
     - name: Build Image
+      if: steps.registry.outputs.enabled == 'true'
       uses: actions/docker-build-push@v6
       with:
         context: .
@@ -50,10 +63,11 @@ jobs:
           COMMIT=${{ steps.build-info.outputs.COMMIT }}
           BUILD=${{ steps.build-info.outputs.BUILD }}
     - name: Test Image
+      if: steps.registry.outputs.enabled == 'true'
       run: |
         docker run --rm ${{ env.REGISTRY}}/${{ env.IMAGE }}:${{ env.TAG }} zs --version
     - name: Publish Image
-      if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master' }}
+      if: steps.registry.outputs.enabled == 'true' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
       uses: actions/docker-build-push@v6
       with:
         context: .