fix: address review comments - inline secret, fail-fast on missing PAT

- Remove temp PAT file entirely; pass secret inline to docker/build-push-action
  using "nuget_pat=${{ secrets.AZURE_DEVOPS_PAT }}" format (eliminates
  temp file creation, permissions concern, and cleanup step)
- Add fail-fast in Dockerfile: if ACCESS_TO_NUGET_FEED=true but secret
  missing, exit 1 with a clear error message instead of silently failing
  with a 401 later

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: BenjaminMichaelis

.github/workflows/Build-Test-And-Deploy.yml

@@ -63,10 +63,6 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
-      - name: Write NuGet PAT for Docker build
-        if: github.event_name != 'pull_request' && github.event_name != 'merge_group'
-        run: echo -n "${{ secrets.AZURE_DEVOPS_PAT }}" > ${{ runner.temp }}/nuget-pat.txt
-
 # Build but no push with a PR
       - name: Docker build (no push)
         if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
@@ -86,7 +82,7 @@ jobs:
           file: ./EssentialCSharp.Web/Dockerfile
           context: .
           secrets: |
-            "id=nuget_pat,src=${{ runner.temp }}/nuget-pat.txt"
+            "nuget_pat=${{ secrets.AZURE_DEVOPS_PAT }}"
           outputs: type=docker,dest=${{ github.workspace }}/essentialcsharpwebimage.tar
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -96,10 +92,6 @@ jobs:
           name: essentialcsharpwebimage
           path: ${{ github.workspace }}/essentialcsharpwebimage.tar
 
-      - name: Clean up NuGet PAT file
-        if: always()
-        run: rm -f ${{ runner.temp }}/nuget-pat.txt
-
   deploy-development:
     if: github.event_name != 'pull_request_target' && github.event_name != 'pull_request'
     runs-on: ubuntu-latest

EssentialCSharp.Web/Dockerfile

@@ -1,4 +1,4 @@
-#syntax=docker/dockerfile:1.2
+# syntax=docker/dockerfile:1.4
 
 FROM mcr.microsoft.com/dotnet/aspnet:10.0-noble-chiseled AS base
 WORKDIR /app
@@ -19,18 +19,20 @@ WORKDIR /src
 COPY . .
 COPY --from=frontend-build /frontend/EssentialCSharp.Web/wwwroot/dist ./EssentialCSharp.Web/wwwroot/dist
 RUN --mount=type=secret,id=nuget_pat,required=false \
-    if [ "$ACCESS_TO_NUGET_FEED" = "true" ] && [ -f /run/secrets/nuget_pat ]; then \
-      cp nuget.config nuget.config.bak && \
+    if [ "$ACCESS_TO_NUGET_FEED" = "true" ] && [ ! -f /run/secrets/nuget_pat ]; then \
+      echo "ERROR: ACCESS_TO_NUGET_FEED=true but nuget_pat secret is missing" >&2; exit 1; \
+    fi && \
+    cp nuget.config nuget.config.bak && \
+    if [ "$ACCESS_TO_NUGET_FEED" = "true" ]; then \
       dotnet nuget update source EssentialCSharp \
-        --username docker \
+        --username az \
         --password "$(cat /run/secrets/nuget_pat)" \
-        --store-password-in-clear-text \
-        --configfile nuget.config; \
+        --store-password-in-clear-text; \
     fi && \
     dotnet restore "EssentialCSharp.Web.slnx" -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED && \
     dotnet build "EssentialCSharp.Web.slnx" -c Release --no-restore -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED -p:ReleaseDateAttribute=True -p:SkipFrontendBuild=true && \
     dotnet publish "EssentialCSharp.Web.slnx" -c Release -p:PublishDir=/app/publish -p:UseAppHost=false -p:SkipFrontendBuild=true --no-build && \
-    if [ -f nuget.config.bak ]; then mv nuget.config.bak nuget.config; fi
+    mv nuget.config.bak nuget.config
 
 FROM base AS final
 WORKDIR /app