Isolate Shardok ARM64 registry auth

.github/workflows/shardok_arm64_build.yml

@@ -36,6 +36,8 @@ permissions:
 jobs:
   build-shardok-arm64:
     runs-on: [self-hosted, bazel]
+    env:
+      DOCKER_CONFIG: ${{ runner.temp }}/shardok-arm64-docker-config
     outputs:
       image_tag: ${{ steps.push-shardok.outputs.image_tag }}
     steps:
@@ -148,8 +150,14 @@ jobs:
         env:
           DO_REGISTRY_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
         run: |
+          if [ -z "${DO_REGISTRY_TOKEN}" ]; then
+            echo "ERROR: DO_REGISTRY_TOKEN is not set"
+            exit 1
+          fi
+
+          mkdir -p "${DOCKER_CONFIG}"
           AUTH=$(echo -n "${DO_REGISTRY_TOKEN}:${DO_REGISTRY_TOKEN}" | base64)
-          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
+          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > "${DOCKER_CONFIG}/config.json"
 
       - name: Push Shardok ARM64 image to DigitalOcean
         id: push-shardok
@@ -202,6 +210,7 @@ jobs:
     environment: production
     env:
       SHARDOK_IMAGE: ${{ needs.build-shardok-arm64.outputs.image_tag }}
+      DOCKER_CONFIG: ${{ runner.temp }}/shardok-arm64-deploy-docker-config
     steps:
       - name: Setup SSH key
         run: |
@@ -217,6 +226,11 @@ jobs:
         run: |
           set -ex
 
+          if [ -z "${DO_REGISTRY_TOKEN}" ]; then
+            echo "ERROR: DO_REGISTRY_TOKEN is not set"
+            exit 1
+          fi
+
           # Hetzner is IPv6-only, while Docker can be redirected to IPv4-only
           # DigitalOcean registry/blob endpoints. Pull on the runner and copy
           # the Docker-loadable tarball over SSH instead.
@@ -233,8 +247,8 @@ jobs:
           fi
 
           AUTH=$(echo -n "${DO_REGISTRY_TOKEN}:${DO_REGISTRY_TOKEN}" | base64)
-          mkdir -p ~/.docker
-          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
+          mkdir -p "${DOCKER_CONFIG}"
+          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > "${DOCKER_CONFIG}/config.json"
 
           IMAGE_TAR="${RUNNER_TEMP}/shardok-arm64-image.tar"
           "$CRANE" pull "${SHARDOK_IMAGE}" "$IMAGE_TAR"