From 06916868fe7c92ee72cc29f28e9e573c7abd4d8b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ullrich=20Sch=C3=A4fer?= Date: Fri, 27 Mar 2026 17:52:41 +0100 Subject: [PATCH] Fix cd-apps: extract SENTRY_AUTH_TOKEN instead of sourcing env file The decrypted secrets.app.env contains values with angle brackets (SMTP_FROM) that bash interprets as redirects. The build job only needs SENTRY_AUTH_TOKEN, so extract it with grep instead. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/cd-apps.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/cd-apps.yml b/.github/workflows/cd-apps.yml index a262ded..f36b864 100644 --- a/.github/workflows/cd-apps.yml +++ b/.github/workflows/cd-apps.yml @@ -33,12 +33,12 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - name: Decrypt app secrets + - name: Decrypt Sentry auth token run: | curl -sLO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.linux.amd64 chmod +x sops-v3.9.4.linux.amd64 SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.app.env > /tmp/secrets.env - source /tmp/secrets.env + echo "SENTRY_AUTH_TOKEN=$(grep SENTRY_AUTH_TOKEN /tmp/secrets.env | cut -d= -f2-)" >> "$GITHUB_ENV" - uses: docker/build-push-action@v7 with: