Fix deploy stdin token handling

.github/workflows/ci.yml

@@ -137,6 +137,6 @@ jobs:
           echo "${{ secrets.VPS_SSH_KEY }}" > ~/.ssh/id_rsa
           chmod 600 ~/.ssh/id_rsa
           scp -o StrictHostKeyChecking=accept-new deploy.sh ${{ secrets.VPS_USER }}@${{ secrets.VPS_HOST }}:/tmp/deploy.sh
-          printf '%s' "$GHCR_PAT" | ssh -o StrictHostKeyChecking=accept-new ${{ secrets.VPS_USER }}@${{ secrets.VPS_HOST }} "
+          printf '%s\n' "$GHCR_PAT" | ssh -o StrictHostKeyChecking=accept-new ${{ secrets.VPS_USER }}@${{ secrets.VPS_HOST }} "
             bash /tmp/deploy.sh '${{ github.sha }}'
           "

deploy.sh

@@ -7,7 +7,11 @@ COMPOSE_DIR="/root/PolyWeather"
 LOCK_FILE="${POLYWEATHER_DEPLOY_LOCK_FILE:-/var/lock/polyweather-deploy.lock}"
 
 GHCR_PAT=""
-if ! IFS= read -r GHCR_PAT || [ -z "$GHCR_PAT" ]; then
+if ! IFS= read -r GHCR_PAT && [ -z "$GHCR_PAT" ]; then
+    echo "❌ GHCR token must be provided on stdin"
+    exit 1
+fi
+if [ -z "$GHCR_PAT" ]; then
     echo "❌ GHCR token must be provided on stdin"
     exit 1
 fi

tests/test_deployment_runtime_config.py

@@ -135,7 +135,7 @@ def test_deploy_token_is_passed_over_stdin_not_process_args():
     assert 'printf \'%s\' "$GHCR_PAT" | docker login' in script
 
     assert "GHCR_PAT: ${{ secrets.GHCR_PAT }}" in workflow
-    assert 'printf \'%s\' "$GHCR_PAT" | ssh' in workflow
+    assert 'printf \'%s\\n\' "$GHCR_PAT" | ssh' in workflow
     assert "bash /tmp/deploy.sh '${{ github.sha }}'" in workflow
     assert "bash /tmp/deploy.sh '${{ secrets.GHCR_PAT }}'" not in workflow