From 55c9154f05f801d282965636b15e9fb63f885ddd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ullrich=20Sch=C3=A4fer?= Date: Sun, 26 Apr 2026 11:53:55 +0200 Subject: [PATCH] Revert cd-apps annotation path: GRAFANA_SERVICE_TOKEN is in .env, not app.env The token lives in `secrets.infra.env`, which `cd-infra.yml` merges together with `secrets.app.env` into the server's `/opt/trails-cool/.env`. The cd-apps workflow's own `app.env` intentionally does NOT carry the token (apps don't need it at runtime), so the original `grep ... .env` was correct. My earlier edit in this branch swapped the path to `app.env` and would have broken the annotation hook the moment it actually worked. Restored `.env` and updated the inline comment to make the file ownership explicit (cd-infra populates it; cd-apps reads it). Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/cd-apps.yml | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/.github/workflows/cd-apps.yml b/.github/workflows/cd-apps.yml index 6277543..cc6d706 100644 --- a/.github/workflows/cd-apps.yml +++ b/.github/workflows/cd-apps.yml @@ -115,14 +115,16 @@ jobs: docker image prune -af docker compose ps - # Annotate deploy in Grafana. The token lives in the - # decrypted SOPS env file we just scp'd to /opt/trails-cool - # — that file is `app.env`, not `.env`. (Pre-fix this read - # the wrong path, so annotations were silently no-op'ing - # every deploy.) `2>/dev/null` keeps a missing token from - # failing the deploy; `|| true` keeps the curl from - # failing the deploy if Grafana itself is unhealthy. - GRAFANA_TOKEN=$(grep GRAFANA_SERVICE_TOKEN app.env 2>/dev/null | cut -d= -f2-) + # Annotate deploy in Grafana. GRAFANA_SERVICE_TOKEN lives + # in secrets.infra.env (decrypted by cd-infra.yml into the + # merged /opt/trails-cool/.env on the server). cd-apps's + # own app.env intentionally does NOT carry it — apps don't + # need it at runtime. So we read from the merged `.env` + # that cd-infra populated. If cd-infra has never run on + # this host, .env may not exist; the `2>/dev/null` and + # the `if -n` guard make the annotation a silent no-op + # rather than a deploy failure in that case. + GRAFANA_TOKEN=$(grep GRAFANA_SERVICE_TOKEN .env 2>/dev/null | cut -d= -f2-) if [ -n "$GRAFANA_TOKEN" ]; then docker compose exec -T grafana curl -sf -X POST \ -H "Authorization: Bearer $GRAFANA_TOKEN" \