TAN-36: update CI/CD env

.github/composite/build-image/action.yml

@@ -9,11 +9,14 @@ inputs:
   ENVIRONMENT:
     description: "'staging' or 'production'"
     required: true
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
-    description: "GPG private key for decrypting secrets."
+    description: "GPG Private Key"
     required: false
   GPG_PASSPHRASE:
-    description: "GPG passphrase for decrypting secrets."
+    description: "GPG Passphrase"
     required: false
 
 outputs:
@@ -27,6 +30,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 

.github/composite/build-image/internal/standup-bot/action.yml

@@ -2,12 +2,15 @@ name: "Build & Upload Docker Image for codebloom-standup-bot"
 description: "Build & (optionally) upload Docker Image to Docker Registry"
 
 inputs:
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
   DOCKER_UPLOAD:
     description: "Boolean indicating whether the image should be uploaded to Docker registry or not."
     required: false
@@ -24,6 +27,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 

.github/composite/deploy-standup-bot/action.yaml

@@ -5,12 +5,15 @@ inputs:
   ENVIRONMENT:
     description: "'staging' or 'production'"
     required: true
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
 
 runs:
   using: composite
@@ -19,6 +22,7 @@ runs:
       id: build-image
       uses: ./.github/composite/build-image/internal/standup-bot
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 

.github/composite/notion-checks/action.yml

@@ -5,12 +5,15 @@ inputs:
   PR_ID:
     description: "PR ID"
     required: true
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
   GET_GHA_OUTPUT:
     description: "If set to `true`, will output an object with data that can be interfaced in GitHub Actions."
     required: false
@@ -31,6 +34,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 

.github/composite/redeploy/action.yml

@@ -2,12 +2,15 @@ name: "Re-Deploy to DigitalOcean"
 description: "Trigger a deployment to DigitalOcean and migrate the associated database."
 
 inputs:
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
   ENVIRONMENT:
     description: '"staging" or "production"'
     required: false
@@ -22,6 +25,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 

.github/composite/redeploy/internal/standup-bot/action.yml

@@ -2,19 +2,23 @@ name: "Re-Deploy codebloom-standup-bot to Coolify"
 description: "Trigger a deployment of the standup bot to Coolify."
 
 inputs:
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
 
 runs:
   using: "composite"
   steps:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 

.github/composite/setup-ci/action.yml

@@ -12,6 +12,9 @@ inputs:
     description: "GitHub token used to send message"
     required: false
     default: ${{ github.token }}
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
 
 runs:
   using: "composite"
@@ -20,6 +23,17 @@ runs:
       shell: bash
       run: echo "GH_TOKEN=${{ inputs.GITHUB_TOKEN }}" >> $GITHUB_ENV
 
+    - name: Export secrets to environment
+      if: inputs.SECRETS != ''
+      shell: bash
+      env:
+        SECRETS_JSON: ${{ inputs.SECRETS }}
+      run: |
+        echo "$SECRETS_JSON" | jq -r 'to_entries[] | "\(.key)=\(.value)"' | while IFS='=' read -r key value; do
+          echo "::add-mask::$value"
+          echo "$key=$value" >> "$GITHUB_ENV"
+        done
+
     - name: Disable man-db
       shell: bash
       run: sudo bash -ec 'echo "set man-db/auto-update false" | debconf-communicate; dpkg-reconfigure man-db'

.github/composite/test/backend-test/action.yml

@@ -2,12 +2,15 @@ name: "Backend test"
 description: "Run backend tests"
 
 inputs:
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
   UPLOAD_TEST_COV:
     description: "Boolean indicating whether tests should be uploaded to our code coverage provider or not."
     required: false
@@ -19,6 +22,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 

.github/composite/test/frontend-pre-test/action.yml

@@ -2,19 +2,23 @@ name: "Frontend Pre Test"
 description: "Run frontend linter & formatter checks + attempt to compile (NO TESTS)"
 
 inputs:
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
 
 runs:
   using: "composite"
   steps:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 

.github/composite/test/frontend-test/action.yml

@@ -2,12 +2,15 @@ name: "Frontend Test"
 description: "Run frontend tests"
 
 inputs:
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
   UPLOAD_TEST_COV:
     description: "Boolean indicating whether tests should be uploaded to our code coverage or not."
     required: false
@@ -19,6 +22,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 

.github/composite/validate-db/action.yml

@@ -2,12 +2,15 @@ name: "Validate DB"
 description: "Validate the current db/ folder at a current commit against a database"
 
 inputs:
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   GPG_PRIVATE_KEY:
     description: "GPG Private Key"
-    required: true
+    required: false
   GPG_PASSPHRASE:
     description: "GPG Passphrase"
-    required: true
+    required: false
   ENVIRONMENT:
     description: '"staging" or "production"'
     required: false
@@ -22,6 +25,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
+        SECRETS: ${{ inputs.SECRETS }}
         GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
         GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
 

.github/scripts/auto-approval/index.ts

@@ -1,6 +1,5 @@
 import type { RestEndpointMethodTypes } from "@octokit/rest";
 
-import { getEnvVariables } from "load-secrets/env/load";
 import { checkNotionPrAndGetTask } from "notion/pr";
 import { getNotionClient } from "notion/sdk";
 import { Octokit } from "octokit";
@@ -34,7 +33,7 @@ const {
   .strict()
   .parse();
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const notionDbId = (() => {
     const v = ciEnv["NOTION_TASK_DB_ID"];
     if (!v) {
@@ -57,7 +56,7 @@ function parseCiEnv(ciEnv: Record<string, string>) {
   };
 }
 
-const { notionDbId, notionSecret } = parseCiEnv(await getEnvVariables(["ci"]));
+const { notionDbId, notionSecret } = parseCiEnv(process.env);
 const notionClient = getNotionClient(notionSecret);
 
 const taskAndPr = await checkNotionPrAndGetTask(notionClient, prId, notionDbId);

.github/scripts/build-image/index.ts

@@ -40,8 +40,7 @@ const serverProfiles = environment === "staging" ? "stg" : "prod";
 
 async function main() {
   try {
-    const ciEnv = await getEnvVariables(["ci"]);
-    const { dockerHubPat } = parseCiEnv(ciEnv);
+    const { dockerHubPat } = parseCiEnv(process.env);
     const localDbEnv = await db.start();
     const ciAppEnv = await getEnvVariables(["ci-app"]);
 
@@ -126,7 +125,7 @@ async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const dockerHubPat = (() => {
     const v = ciEnv["DOCKER_HUB_PAT"];
     if (!v) {

.github/scripts/build-image/internal/standup-bot.ts

@@ -1,5 +1,4 @@
 import { $ } from "bun";
-import { getEnvVariables } from "load-secrets/env/load";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 
@@ -27,8 +26,7 @@ const { dockerUpload, getGhaOutput, githubOutputFile } = await yargs(
   .parse();
 
 async function main() {
-  const ciEnv = await getEnvVariables(["ci"]);
-  const { dockerHubPat } = parseCiEnv(ciEnv);
+  const { dockerHubPat } = parseCiEnv(process.env);
 
   // copy old tz format from build-image.sh
   const timestamp = new Date()
@@ -94,7 +92,7 @@ async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const dockerHubPat = (() => {
     const v = ciEnv["DOCKER_HUB_PAT"];
     if (!v) {

.github/scripts/deploy/index.ts

@@ -1,7 +1,7 @@
 import type { Environment } from "@tahminator/pipeline";
 import type { Type } from "types";
 
-import { GitHubClient, Utils } from "@tahminator/pipeline";
+import { GitHubClient } from "@tahminator/pipeline";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 
@@ -24,8 +24,7 @@ const { environment, newTagVersion, type } = await yargs(hideBin(process.argv))
   .parse();
 
 async function main() {
-  const ciEnv = await Utils.getEnvVariables(["ci"]);
-  const { ghPat } = parseCiEnv(ciEnv);
+  const { ghPat } = parseCiEnv(process.env);
   const ghClient = new GitHubClient(ghPat);
 
   if (type === "web") {
@@ -51,7 +50,7 @@ async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const ghPat = (() => {
     const v = ciEnv["GH_PAT"];
     if (!v) {