Challenge 2: Secure the Registry Login Step — Possible Solution
====================================================================

echo "$REGISTRY_PASSWORD" | docker login registry.example.com -u "$REGISTRY_USER" --password-stdin

(With REGISTRY_USER and REGISTRY_PASSWORD configured as CI secrets,
never written into the pipeline file itself.)

WHY THIS WORKS AS AN ANSWER
------------------------------
The original version hardcodes both the username (admin) and password
(Sup3rSecret) directly as literal text in the pipeline configuration
file — meaning anyone with read access to that file (or its Git
history, since pipeline configs are typically version-controlled) has
the real registry credentials in plain sight, permanently, the exact
same class of mistake Chapter 6 flagged for credentials baked into a
Dockerfile.

The fixed version replaces both hardcoded values with references to
CI secrets ($REGISTRY_USER, $REGISTRY_PASSWORD) — the actual values
are configured separately in the CI platform's own secrets store
(exactly the same pattern pipelines1-5 established for any credential
used in a pipeline), never appearing as literal text anywhere in the
pipeline file or its history.

Using --password-stdin (piping the password in via echo, rather than
passing it as a -p flag argument) is also a meaningful detail: command-
line arguments are often visible in process listings or shell history
on the machine running them, while piping via stdin avoids that
additional exposure path.