From 1e2861186701570bb6f1c1372d4b7f46e8dcb06c Mon Sep 17 00:00:00 2001
From: Josh <jcoakley@aptivaai.com>
Date: Fri, 12 Sep 2025 16:38:15 +0000
Subject: [PATCH] impersonation moved

---
 .woodpecker.yml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.woodpecker.yml b/.woodpecker.yml
index 28a63b4..2a16e22 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -19,10 +19,14 @@ steps:
         [ -n "$IMG_TAG" ] || { echo "❌ IMG_TAG empty"; exit 2; }
 
         apt-get update -qq && apt-get install -y -qq skopeo
+
+        # 👉 impersonate BEFORE minting any tokens
+        gcloud config set auth/impersonate_service_account "woodpecker-ci@aptivaai-dev.iam.gserviceaccount.com" >/dev/null
+        echo "impersonating: $(gcloud config get-value auth/impersonate_service_account)"
+
         TOKEN="$(gcloud auth print-access-token)"
 
-        # Check which images are already in PROD; no arrays to avoid bad-substitution
-        gcloud config set auth/impersonate_service_account "woodpecker-ci@aptivaai-dev.iam.gserviceaccount.com"
+        # Check which images already exist in PROD (so we don't try to push them)
         MISSING=""
         for s in server1 server2 server3 nginx; do
           REF="docker://$DST/$s:$IMG_TAG"
@@ -34,7 +38,7 @@ steps:
         if [ -z "$MISSING" ]; then
           echo "✅ All images present in PROD for :$IMG_TAG — skipping mirror"
         else
-          echo "🔁 Mirroring to PROD: $MISSING"
+          echo "🔁 Mirroring to PROD:$MISSING"
           for s in $MISSING; do
             SRC_REF="docker://$SRC/$s:$IMG_TAG"
             DST_REF="docker://$DST/$s:$IMG_TAG"