From 73683381e6ff5fa8bc4fafeb1bdaf8bb4a8fe178 Mon Sep 17 00:00:00 2001
From: Nancy Huang <205217630+naanci@users.noreply.github.com>
Date: Sat, 15 Aug 2026 17:29:53 -0400
Subject: [PATCH 1/2] TAN-36: changes made to read CI secrets from process.env
 instead of decrypted .env.ci files

TAN-36: error call fix

TAN-36: changed secret call in composite folder

TAN-36: fix composite actions calling toJSON(secrets) directly

TAN-36: restore GPG secret forwarding for git-crypt
---
 .github/composite/build-image/action.yml              |  8 ++++++--
 .../build-image/internal/standup-bot/action.yml       |  8 ++++++--
 .github/composite/deploy-standup-bot/action.yaml      |  8 ++++++--
 .github/composite/notion-checks/action.yml            |  8 ++++++--
 .github/composite/redeploy/action.yml                 |  8 ++++++--
 .../redeploy/internal/standup-bot/action.yml          |  8 ++++++--
 .github/composite/setup-ci/action.yml                 |  3 +++
 .github/composite/test/backend-test/action.yml        |  8 ++++++--
 .github/composite/test/frontend-pre-test/action.yml   |  8 ++++++--
 .github/composite/test/frontend-test/action.yml       |  8 ++++++--
 .github/composite/validate-db/action.yml              |  8 ++++++--
 .github/scripts/auto-approval/index.ts                |  5 ++---
 .github/scripts/build-image/index.ts                  |  5 ++---
 .github/scripts/build-image/internal/standup-bot.ts   |  6 ++----
 .github/scripts/deploy/index.ts                       |  7 +++----
 .github/scripts/notion/index.ts                       |  7 ++-----
 .../scripts/redeploy/internal/standup-bot/index.ts    |  6 ++----
 .github/scripts/test/run-backend-tests.ts             |  5 ++---
 .github/scripts/test/run-e2e-tests.ts                 |  6 ++----
 .github/scripts/test/run-frontend-tests.ts            |  5 ++---
 .github/workflows/ai-command.yml                      |  2 ++
 .github/workflows/ai-review.yml                       |  3 +++
 .github/workflows/ci-cd.yml                           | 11 +++++++++--
 .github/workflows/copy-command.yml                    |  1 +
 .github/workflows/deploy-command.yml                  |  6 ++++++
 .github/workflows/e2e.yml                             |  1 +
 .github/workflows/help-command.yml                    |  1 +
 .github/workflows/pr-verifications.yml                |  3 +--
 .github/workflows/slash.yml                           |  2 ++
 29 files changed, 108 insertions(+), 57 deletions(-)

diff --git a/.github/composite/build-image/action.yml b/.github/composite/build-image/action.yml
index 52052de53..ad72c49d1 100644
--- a/.github/composite/build-image/action.yml
+++ b/.github/composite/build-image/action.yml
@@ -9,11 +9,14 @@ inputs:
   ENVIRONMENT:
     description: "'staging' or 'production'"
     required: true
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
-    description: "GPG private key for decrypting secrets."
+    description: "GPG Private Key"
     required: false
   GPG_PASSPHRASE:
-    description: "GPG passphrase for decrypting secrets."
+    description: "GPG Passphrase"
     required: false
 
 outputs:
@@ -27,6 +30,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 
diff --git a/.github/composite/build-image/internal/standup-bot/action.yml b/.github/composite/build-image/internal/standup-bot/action.yml
index 4232fa653..7551f5eae 100644
--- a/.github/composite/build-image/internal/standup-bot/action.yml
+++ b/.github/composite/build-image/internal/standup-bot/action.yml
@@ -2,12 +2,15 @@ name: "Build & Upload Docker Image for codebloom-standup-bot"
 description: "Build & (optionally) upload Docker Image to Docker Registry"
 
 inputs:
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
   DOCKER_UPLOAD:
     description: "Boolean indicating whether the image should be uploaded to Docker registry or not."
     required: false
@@ -24,6 +27,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 
diff --git a/.github/composite/deploy-standup-bot/action.yaml b/.github/composite/deploy-standup-bot/action.yaml
index ea18f44a2..30a73b430 100644
--- a/.github/composite/deploy-standup-bot/action.yaml
+++ b/.github/composite/deploy-standup-bot/action.yaml
@@ -5,12 +5,15 @@ inputs:
   ENVIRONMENT:
     description: "'staging' or 'production'"
     required: true
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
 
 runs:
   using: composite
@@ -19,6 +22,7 @@ runs:
       id: build-image
       uses: ./.github/composite/build-image/internal/standup-bot
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 
diff --git a/.github/composite/notion-checks/action.yml b/.github/composite/notion-checks/action.yml
index 2d506d33c..8198c37de 100644
--- a/.github/composite/notion-checks/action.yml
+++ b/.github/composite/notion-checks/action.yml
@@ -5,12 +5,15 @@ inputs:
   PR_ID:
     description: "PR ID"
     required: true
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
   GET_GHA_OUTPUT:
     description: "If set to `true`, will output an object with data that can be interfaced in GitHub Actions."
     required: false
@@ -31,6 +34,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 
diff --git a/.github/composite/redeploy/action.yml b/.github/composite/redeploy/action.yml
index 3076545a5..f65b14983 100644
--- a/.github/composite/redeploy/action.yml
+++ b/.github/composite/redeploy/action.yml
@@ -2,12 +2,15 @@ name: "Re-Deploy to DigitalOcean"
 description: "Trigger a deployment to DigitalOcean and migrate the associated database."
 
 inputs:
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
   ENVIRONMENT:
     description: '"staging" or "production"'
     required: false
@@ -22,6 +25,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 
diff --git a/.github/composite/redeploy/internal/standup-bot/action.yml b/.github/composite/redeploy/internal/standup-bot/action.yml
index 7eae77290..254accb68 100644
--- a/.github/composite/redeploy/internal/standup-bot/action.yml
+++ b/.github/composite/redeploy/internal/standup-bot/action.yml
@@ -2,12 +2,15 @@ name: "Re-Deploy codebloom-standup-bot to Coolify"
 description: "Trigger a deployment of the standup bot to Coolify."
 
 inputs:
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
 
 runs:
   using: "composite"
@@ -15,6 +18,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 
diff --git a/.github/composite/setup-ci/action.yml b/.github/composite/setup-ci/action.yml
index 6e236f41d..92a34199d 100644
--- a/.github/composite/setup-ci/action.yml
+++ b/.github/composite/setup-ci/action.yml
@@ -12,6 +12,9 @@ inputs:
     description: "GitHub token used to send message"
     required: false
     default: ${{ github.token }}
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
 
 runs:
   using: "composite"
diff --git a/.github/composite/test/backend-test/action.yml b/.github/composite/test/backend-test/action.yml
index 79d26f443..d31133a10 100644
--- a/.github/composite/test/backend-test/action.yml
+++ b/.github/composite/test/backend-test/action.yml
@@ -2,12 +2,15 @@ name: "Backend test"
 description: "Run backend tests"
 
 inputs:
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
   UPLOAD_TEST_COV:
     description: "Boolean indicating whether tests should be uploaded to our code coverage provider or not."
     required: false
@@ -19,6 +22,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 
diff --git a/.github/composite/test/frontend-pre-test/action.yml b/.github/composite/test/frontend-pre-test/action.yml
index 369a62619..b8fd0434b 100644
--- a/.github/composite/test/frontend-pre-test/action.yml
+++ b/.github/composite/test/frontend-pre-test/action.yml
@@ -2,12 +2,15 @@ name: "Frontend Pre Test"
 description: "Run frontend linter & formatter checks + attempt to compile (NO TESTS)"
 
 inputs:
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
 
 runs:
   using: "composite"
@@ -15,6 +18,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 
diff --git a/.github/composite/test/frontend-test/action.yml b/.github/composite/test/frontend-test/action.yml
index 61bf09067..f53f9c421 100644
--- a/.github/composite/test/frontend-test/action.yml
+++ b/.github/composite/test/frontend-test/action.yml
@@ -2,12 +2,15 @@ name: "Frontend Test"
 description: "Run frontend tests"
 
 inputs:
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
   UPLOAD_TEST_COV:
     description: "Boolean indicating whether tests should be uploaded to our code coverage or not."
     required: false
@@ -19,6 +22,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 
diff --git a/.github/composite/validate-db/action.yml b/.github/composite/validate-db/action.yml
index 70fb3a18a..5470098a9 100644
--- a/.github/composite/validate-db/action.yml
+++ b/.github/composite/validate-db/action.yml
@@ -2,12 +2,15 @@ name: "Validate DB"
 description: "Validate the current db/ folder at a current commit against a database"
 
 inputs:
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
   ENVIRONMENT:
     description: '"staging" or "production"'
     required: false
@@ -22,6 +25,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 
diff --git a/.github/scripts/auto-approval/index.ts b/.github/scripts/auto-approval/index.ts
index 675b39418..5a28d5089 100644
--- a/.github/scripts/auto-approval/index.ts
+++ b/.github/scripts/auto-approval/index.ts
@@ -1,6 +1,5 @@
 import type { RestEndpointMethodTypes } from "@octokit/rest";
 
-import { getEnvVariables } from "load-secrets/env/load";
 import { checkNotionPrAndGetTask } from "notion/pr";
 import { getNotionClient } from "notion/sdk";
 import { Octokit } from "octokit";
@@ -34,7 +33,7 @@ const {
   .strict()
   .parse();
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const notionDbId = (() => {
     const v = ciEnv["NOTION_TASK_DB_ID"];
     if (!v) {
@@ -57,7 +56,7 @@ function parseCiEnv(ciEnv: Record<string, string>) {
   };
 }
 
-const { notionDbId, notionSecret } = parseCiEnv(await getEnvVariables(["ci"]));
+const { notionDbId, notionSecret } = parseCiEnv(process.env);
 const notionClient = getNotionClient(notionSecret);
 
 const taskAndPr = await checkNotionPrAndGetTask(notionClient, prId, notionDbId);
diff --git a/.github/scripts/build-image/index.ts b/.github/scripts/build-image/index.ts
index 458157e5f..d249d70ae 100644
--- a/.github/scripts/build-image/index.ts
+++ b/.github/scripts/build-image/index.ts
@@ -40,8 +40,7 @@ const serverProfiles = environment === "staging" ? "stg" : "prod";
 
 async function main() {
   try {
-    const ciEnv = await getEnvVariables(["ci"]);
-    const { dockerHubPat } = parseCiEnv(ciEnv);
+    const { dockerHubPat } = parseCiEnv(process.env);
     const localDbEnv = await db.start();
     const ciAppEnv = await getEnvVariables(["ci-app"]);
 
@@ -126,7 +125,7 @@ async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const dockerHubPat = (() => {
     const v = ciEnv["DOCKER_HUB_PAT"];
     if (!v) {
diff --git a/.github/scripts/build-image/internal/standup-bot.ts b/.github/scripts/build-image/internal/standup-bot.ts
index 6b3405133..44227c1d6 100644
--- a/.github/scripts/build-image/internal/standup-bot.ts
+++ b/.github/scripts/build-image/internal/standup-bot.ts
@@ -1,5 +1,4 @@
 import { $ } from "bun";
-import { getEnvVariables } from "load-secrets/env/load";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 
@@ -27,8 +26,7 @@ const { dockerUpload, getGhaOutput, githubOutputFile } = await yargs(
   .parse();
 
 async function main() {
-  const ciEnv = await getEnvVariables(["ci"]);
-  const { dockerHubPat } = parseCiEnv(ciEnv);
+  const { dockerHubPat } = parseCiEnv(process.env);
 
   // copy old tz format from build-image.sh
   const timestamp = new Date()
@@ -94,7 +92,7 @@ async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const dockerHubPat = (() => {
     const v = ciEnv["DOCKER_HUB_PAT"];
     if (!v) {
diff --git a/.github/scripts/deploy/index.ts b/.github/scripts/deploy/index.ts
index 15de5e56d..d49ca1918 100644
--- a/.github/scripts/deploy/index.ts
+++ b/.github/scripts/deploy/index.ts
@@ -1,7 +1,7 @@
 import type { Environment } from "@tahminator/pipeline";
 import type { Type } from "types";
 
-import { GitHubClient, Utils } from "@tahminator/pipeline";
+import { GitHubClient } from "@tahminator/pipeline";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 
@@ -24,8 +24,7 @@ const { environment, newTagVersion, type } = await yargs(hideBin(process.argv))
   .parse();
 
 async function main() {
-  const ciEnv = await Utils.getEnvVariables(["ci"]);
-  const { ghPat } = parseCiEnv(ciEnv);
+  const { ghPat } = parseCiEnv(process.env);
   const ghClient = new GitHubClient(ghPat);
 
   if (type === "web") {
@@ -51,7 +50,7 @@ async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const ghPat = (() => {
     const v = ciEnv["GH_PAT"];
     if (!v) {
diff --git a/.github/scripts/notion/index.ts b/.github/scripts/notion/index.ts
index 3587b25c3..ce37f70eb 100644
--- a/.github/scripts/notion/index.ts
+++ b/.github/scripts/notion/index.ts
@@ -1,4 +1,3 @@
-import { getEnvVariables } from "load-secrets/env/load";
 import { _checkCommits } from "notion/commits";
 import { checkNotionPrAndGetTask } from "notion/pr";
 import { _validateNotionTask } from "notion/pr/validate-ticket";
@@ -42,9 +41,7 @@ const {
 async function main() {
   console.log(`GET_GHA_OUTPUT=${getGhaOutput}`);
 
-  const { notionDbId, notionSecret } = parseCiEnv(
-    await getEnvVariables(["ci"]),
-  );
+  const { notionDbId, notionSecret } = parseCiEnv(process.env);
   const client = getNotionClient(notionSecret);
 
   const { taskId, taskContent, task, taskPublicUrl } =
@@ -72,7 +69,7 @@ async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const notionDbId = (() => {
     const v = ciEnv["NOTION_TASK_DB_ID"];
     if (!v) {
diff --git a/.github/scripts/redeploy/internal/standup-bot/index.ts b/.github/scripts/redeploy/internal/standup-bot/index.ts
index 12274da87..d25d1b356 100644
--- a/.github/scripts/redeploy/internal/standup-bot/index.ts
+++ b/.github/scripts/redeploy/internal/standup-bot/index.ts
@@ -11,9 +11,7 @@ async function main() {
   // await $`git-crypt unlock`;
 
   const { bearerAuth, serverUrl, projectUuid, serverUuid } = parseCiEnv(
-    await getEnvVariables(["ci"], {
-      baseDir: "internal",
-    }),
+    process.env,
   );
 
   const client = await initClient(bearerAuth, serverUrl);
@@ -74,7 +72,7 @@ async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const bearerAuth = (() => {
     const v = ciEnv["COOLIFY_BEARER_AUTH"];
     if (!v) {
diff --git a/.github/scripts/test/run-backend-tests.ts b/.github/scripts/test/run-backend-tests.ts
index 4c078b7d6..7548c88a8 100644
--- a/.github/scripts/test/run-backend-tests.ts
+++ b/.github/scripts/test/run-backend-tests.ts
@@ -44,8 +44,7 @@ async function main() {
     await $$`./mvnw clean verify -Dspring.profiles.active=ci`;
 
     if (shouldUploadCoverage) {
-      const ciEnv = await getEnvVariables(["ci"]);
-      const { sonarToken } = parseCiEnv(ciEnv);
+      const { sonarToken } = parseCiEnv(process.env);
       await uploadBackendTests(sonarToken);
     }
   } finally {
@@ -55,7 +54,7 @@ async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const sonarToken = (() => {
     const v = ciEnv["SONAR_TOKEN"];
     if (!v) {
diff --git a/.github/scripts/test/run-e2e-tests.ts b/.github/scripts/test/run-e2e-tests.ts
index 6f73b39d5..fa9b63552 100644
--- a/.github/scripts/test/run-e2e-tests.ts
+++ b/.github/scripts/test/run-e2e-tests.ts
@@ -20,9 +20,7 @@ const { actionUrl, skipDiscordMessage } = await yargs(hideBin(process.argv))
   .parse();
 
 async function main() {
-  const { discordToken, discordChannelId } = parseCiEnv(
-    await getEnvVariables(["ci"]),
-  );
+  const { discordToken, discordChannelId } = parseCiEnv(process.env);
   try {
     const ciAppEnv = await getEnvVariables(["ci-app"]);
 
@@ -81,7 +79,7 @@ main()
     process.exit(1);
   });
 
-function parseCiEnv(env: Record<string, string>) {
+function parseCiEnv(env: Record<string, string | undefined>) {
   const discordToken = env["DISCORD_TOKEN"];
   if (!discordToken) {
     throw new Error("Missing DISCORD_TOKEN from .env.ci");
diff --git a/.github/scripts/test/run-frontend-tests.ts b/.github/scripts/test/run-frontend-tests.ts
index 6d53421d2..3aca02e51 100644
--- a/.github/scripts/test/run-frontend-tests.ts
+++ b/.github/scripts/test/run-frontend-tests.ts
@@ -30,8 +30,7 @@ async function main() {
     await $$`pnpm --dir js run test`;
 
     if (shouldUploadCoverage) {
-      const ciEnv = await getEnvVariables(["ci"]);
-      const { sonarToken } = parseCiEnv(ciEnv);
+      const { sonarToken } = parseCiEnv(process.env);
 
       await uploadFrontendTests(sonarToken);
     }
@@ -41,7 +40,7 @@ async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const sonarToken = (() => {
     const v = ciEnv["SONAR_TOKEN"];
     if (!v) {
diff --git a/.github/workflows/ai-command.yml b/.github/workflows/ai-command.yml
index 80c021c1d..5be5975e6 100644
--- a/.github/workflows/ai-command.yml
+++ b/.github/workflows/ai-command.yml
@@ -61,12 +61,14 @@ jobs:
       - name: Setup CI
         uses: ./.github/composite/setup-ci
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
       - name: Load secrets
         uses: ./.github/composite/load-secrets
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
           UNLOAD_ENVIRONMENTS: ci
diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
index 9fd324022..5f8d21e97 100644
--- a/.github/workflows/ai-review.yml
+++ b/.github/workflows/ai-review.yml
@@ -58,12 +58,14 @@ jobs:
       - name: Setup CI
         uses: ./.github/composite/setup-ci
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
       - name: Load secrets
         uses: ./.github/composite/load-secrets
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
           UNLOAD_ENVIRONMENTS: ci
@@ -73,6 +75,7 @@ jobs:
         id: notion_check
         with:
           PR_ID: ${{ github.event.number || github.event.issue.number  }}
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
           GET_GHA_OUTPUT: "true"
diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index b6c0344cd..147a9efc8 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -61,6 +61,7 @@ jobs:
       - name: Run workflow
         uses: ./.github/composite/test/backend-test
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
@@ -76,6 +77,7 @@ jobs:
       - name: Run workflow
         uses: ./.github/composite/test/frontend-test
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
@@ -93,6 +95,7 @@ jobs:
       - name: Setup CI
         uses: ./.github/composite/setup-ci
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
@@ -140,6 +143,7 @@ jobs:
       - name: Run workflow
         uses: ./.github/composite/build-image/internal/standup-bot
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
           DOCKER_UPLOAD: false
@@ -156,6 +160,7 @@ jobs:
       - name: Run workflow
         uses: ./.github/composite/validate-db
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
   
@@ -174,6 +179,7 @@ jobs:
         uses: ./.github/composite/build-image
         with:
           environment: production
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
@@ -190,6 +196,7 @@ jobs:
       - name: Run workflow
         uses: ./.github/composite/build-image/internal/standup-bot
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
@@ -208,6 +215,7 @@ jobs:
       - name: Run workflow
         uses: ./.github/composite/redeploy
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
@@ -226,5 +234,4 @@ jobs:
   #     - name: Run workflow
   #       uses: ./.github/composite/redeploy/internal/standup-bot
   #       with:
-  #         GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-  #         GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+  #         SECRETS: ${{ toJSON(secrets) }}
diff --git a/.github/workflows/copy-command.yml b/.github/workflows/copy-command.yml
index bf802fc33..724e1e0a8 100644
--- a/.github/workflows/copy-command.yml
+++ b/.github/workflows/copy-command.yml
@@ -56,6 +56,7 @@ jobs:
       - name: Setup CI
         uses: ./.github/composite/setup-ci
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
diff --git a/.github/workflows/deploy-command.yml b/.github/workflows/deploy-command.yml
index b97ccde82..f7301965f 100644
--- a/.github/workflows/deploy-command.yml
+++ b/.github/workflows/deploy-command.yml
@@ -111,12 +111,14 @@ jobs:
       - name: Setup CI
         uses: ./.github/composite/setup-ci
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
       - name: Load secrets
         uses: ./.github/composite/load-secrets
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
           UNLOAD_ENVIRONMENTS: ci
@@ -151,6 +153,7 @@ jobs:
       - name: Run workflow
         uses: ./.github/composite/test/frontend-pre-test
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
@@ -185,6 +188,7 @@ jobs:
       - name: Run workflow
         uses: ./.github/composite/validate-db
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
           ENVIRONMENT: staging
@@ -213,6 +217,7 @@ jobs:
         uses: ./.github/composite/build-image
         with:
           ENVIRONMENT: staging
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
@@ -232,6 +237,7 @@ jobs:
       - name: Run workflow
         uses: ./.github/composite/redeploy
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
           ENVIRONMENT: staging
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 5c0052bfa..2fc7bf193 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -23,6 +23,7 @@ jobs:
       - name: Setup CI
         uses: ./.github/composite/setup-ci
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
diff --git a/.github/workflows/help-command.yml b/.github/workflows/help-command.yml
index 00616e2c4..d851b3f68 100644
--- a/.github/workflows/help-command.yml
+++ b/.github/workflows/help-command.yml
@@ -20,6 +20,7 @@ jobs:
       - name: Setup CI
         uses: ./.github/composite/setup-ci
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
diff --git a/.github/workflows/pr-verifications.yml b/.github/workflows/pr-verifications.yml
index e03580eac..45f67bfc2 100644
--- a/.github/workflows/pr-verifications.yml
+++ b/.github/workflows/pr-verifications.yml
@@ -34,5 +34,4 @@ jobs:
 #        id: notion_check
 #        with:
 #          PR_ID: ${{ github.event.number }}
-#          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-#          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+#          SECRETS: ${{ toJSON(secrets) }}
diff --git a/.github/workflows/slash.yml b/.github/workflows/slash.yml
index d66c9c3af..4d76b2f3c 100644
--- a/.github/workflows/slash.yml
+++ b/.github/workflows/slash.yml
@@ -51,6 +51,7 @@ jobs:
       - name: Setup CI
         uses: ./.github/composite/setup-ci
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
@@ -61,6 +62,7 @@ jobs:
       - name: Load secrets
         uses: ./.github/composite/load-secrets
         with:
+          SECRETS: ${{ toJSON(secrets) }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
           UNLOAD_ENVIRONMENTS: ci

From 06e05912871eced172750306b7b7a356d9b1aca8 Mon Sep 17 00:00:00 2001
From: Nancy Huang <205217630+naanci@users.noreply.github.com>
Date: Sun, 30 Aug 2026 21:19:05 -0400
Subject: [PATCH 2/2] TAN-36: fix setup-ci not exporting SECRETS to process.env

---
 .github/composite/setup-ci/action.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/composite/setup-ci/action.yml b/.github/composite/setup-ci/action.yml
index 92a34199d..bd1ccdc1c 100644
--- a/.github/composite/setup-ci/action.yml
+++ b/.github/composite/setup-ci/action.yml
@@ -23,6 +23,17 @@ runs:
       shell: bash
       run: echo "GH_TOKEN=${{ inputs.GITHUB_TOKEN }}" >> $GITHUB_ENV
 
+    - name: Export secrets to environment
+      if: inputs.SECRETS != ''
+      shell: bash
+      env:
+        SECRETS_JSON: ${{ inputs.SECRETS }}
+      run: |
+        echo "$SECRETS_JSON" | jq -r 'to_entries[] | "\(.key)=\(.value)"' | while IFS='=' read -r key value; do
+          echo "::add-mask::$value"
+          echo "$key=$value" >> "$GITHUB_ENV"
+        done
+
     - name: Disable man-db
       shell: bash
       run: sudo bash -ec 'echo "set man-db/auto-update false" | debconf-communicate; dpkg-reconfigure man-db'