fix: ci

.forgejo/workflows/ci.yml

@@ -41,14 +41,11 @@ jobs:
             - name: Checkout
               uses: actions/checkout@v4
 
-            - name: Inject Auth
-              run: echo "//git.mcpeakdev.com/api/packages/McPeakDev/npm/:_authToken=${BUN_AUTH_TOKEN}" > /root/.npmrc
-              env:
-                  BUN_AUTH_TOKEN: ${{ secrets.BUN_AUTH_TOKEN }}
-
             - name: Install dependencies
               run: bun install --frozen-lockfile
               working-directory: ui
+              env:
+                  BUN_AUTH_TOKEN: ${{ secrets.BUN_AUTH_TOKEN }}
 
             - name: Audit dependencies
               run: bun audit || true
@@ -92,3 +89,5 @@ jobs:
                       git.mcpeakdev.com/mcpeakdev/mercury:latest
                   cache-from: type=registry,ref=git.mcpeakdev.com/mcpeakdev/mercury:latest
                   cache-to: type=inline
+                  secrets: |
+                      bun_auth_token=${{ secrets.BUN_AUTH_TOKEN }}

Dockerfile

@@ -2,6 +2,10 @@
 FROM oven/bun:1-alpine AS ui-builder
 WORKDIR /ui
 COPY ui/ .
+RUN --mount=type=secret,id=bun_auth_token \
+    printf '//git.mcpeakdev.com/api/packages/McPeakDev/npm/:_authToken=%s\n@nychthemeron:registry=https://git.mcpeakdev.com/api/packages/McPeakDev/npm/\n' \
+    "$(cat /run/secrets/bun_auth_token)" > .npmrc && \
+    bun install --frozen-lockfile
 RUN bun run build
 
 # Stage 2: Build Rust API

ui/.gitignore

@@ -1,5 +1,6 @@
 node_modules/
 dist/
+.npmrc
 
 # vue-tsc emit artifacts (should never appear in src/ — noEmit is set)
 src/**/*.vue.js

ui/bunfig.toml

@@ -0,0 +1,2 @@
+[install.scopes]
+"@nychthemeron" = { url = "https://git.mcpeakdev.com/api/packages/McPeakDev/npm/" }