Fix staging auto-deploy: env write + port isolation (#3)

2026-07-01 12:50:12 +02:00
parent 8727be9e94
commit d9a07a01b2
2 changed files with 16 additions and 15 deletions
@@ -22,18 +22,17 @@ jobs:

      - name: Write staging env from secrets
        shell: powershell
-        # Single-quoted here-string: Gitea substitutes the ${{ secrets.* }} tokens
-        # before the shell runs, and PowerShell then treats the values literally
-        # (no $ interpolation). ascii = no BOM, which docker compose's env parser needs.
+        # Per-line writes (not a here-string) so the step can't be broken by how the
+        # runner indents/wraps the script. Gitea substitutes ${{ secrets.* }} first;
+        # ascii = no BOM, which docker compose's env parser needs.
        run: |
-          @'
-          POSTGRES_PASSWORD=${{ secrets.STAGING_POSTGRES_PASSWORD }}
-          GOOGLE_CLIENT_ID=${{ secrets.STAGING_GOOGLE_CLIENT_ID }}
-          GOOGLE_CLIENT_SECRET=${{ secrets.STAGING_GOOGLE_CLIENT_SECRET }}
-          AI_MODE=Disabled
-          FRONTEND_ORIGIN=http://localhost:18081
-          MAX_MESSAGES=2000
-          '@ | Out-File -FilePath deploy/.env.staging -Encoding ascii
+          Set-Content deploy/.env.staging "POSTGRES_PASSWORD=${{ secrets.STAGING_POSTGRES_PASSWORD }}" -Encoding ascii
+          Add-Content deploy/.env.staging "GOOGLE_CLIENT_ID=${{ secrets.STAGING_GOOGLE_CLIENT_ID }}" -Encoding ascii
+          Add-Content deploy/.env.staging "GOOGLE_CLIENT_SECRET=${{ secrets.STAGING_GOOGLE_CLIENT_SECRET }}" -Encoding ascii
+          Add-Content deploy/.env.staging "AI_MODE=Disabled" -Encoding ascii
+          Add-Content deploy/.env.staging "FRONTEND_ORIGIN=http://localhost:18081" -Encoding ascii
+          Add-Content deploy/.env.staging "MAX_MESSAGES=2000" -Encoding ascii
+          Write-Host "wrote $((Get-Content deploy/.env.staging).Count) env lines"

      - name: Redeploy staging stack
        shell: powershell