From e880e3e9d91e7c622dda15d879a7d49e97a3ad91 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ullrich=20Sch=C3=A4fer?= <hi+github@ullrich.is>
Date: Fri, 27 Mar 2026 17:43:30 +0100
Subject: [PATCH] Fix SCP path for decrypted secrets in CD workflows

Write decrypted env files to infrastructure/ instead of /tmp/ so
strip_components: 1 correctly places them on the server.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/cd-apps.yml  | 10 +++++-----
 .github/workflows/cd-infra.yml | 14 ++++++--------
 2 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/cd-apps.yml b/.github/workflows/cd-apps.yml
index 7c9fc7c..a262ded 100644
--- a/.github/workflows/cd-apps.yml
+++ b/.github/workflows/cd-apps.yml
@@ -64,9 +64,9 @@ jobs:
         run: |
           curl -sLO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.linux.amd64
           chmod +x sops-v3.9.4.linux.amd64
-          SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.app.env > /tmp/app.env
-          echo "SENTRY_RELEASE=${{ github.sha }}" >> /tmp/app.env
-          echo "DOMAIN=trails.cool" >> /tmp/app.env
+          SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.app.env > infrastructure/app.env
+          echo "SENTRY_RELEASE=${{ github.sha }}" >> infrastructure/app.env
+          echo "DOMAIN=trails.cool" >> infrastructure/app.env
 
       - name: Copy files to server
         uses: appleboy/scp-action@v1
@@ -84,9 +84,9 @@ jobs:
           host: ${{ secrets.DEPLOY_HOST }}
           username: root
           key: ${{ secrets.DEPLOY_SSH_KEY }}
-          source: "/tmp/app.env"
+          source: "infrastructure/app.env"
           target: /opt/trails-cool
-          strip_components: 2
+          strip_components: 1
 
       - name: Deploy via SSH
         uses: appleboy/ssh-action@v1
diff --git a/.github/workflows/cd-infra.yml b/.github/workflows/cd-infra.yml
index 3b0520e..82194a8 100644
--- a/.github/workflows/cd-infra.yml
+++ b/.github/workflows/cd-infra.yml
@@ -29,9 +29,9 @@ jobs:
           curl -sLO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.linux.amd64
           chmod +x sops-v3.9.4.linux.amd64
           # Merge app + infra secrets into one .env for docker-compose
-          SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.app.env > /tmp/all.env
-          SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.infra.env >> /tmp/all.env
-          echo "DOMAIN=trails.cool" >> /tmp/all.env
+          SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.app.env > infrastructure/.env
+          SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.infra.env >> infrastructure/.env
+          echo "DOMAIN=trails.cool" >> infrastructure/.env
 
       - name: Copy configs to server
         uses: appleboy/scp-action@v1
@@ -49,9 +49,9 @@ jobs:
           host: ${{ secrets.DEPLOY_HOST }}
           username: root
           key: ${{ secrets.DEPLOY_SSH_KEY }}
-          source: "/tmp/all.env"
+          source: "infrastructure/.env"
           target: /opt/trails-cool
-          strip_components: 2
+          strip_components: 1
 
       - name: Deploy via SSH
         uses: appleboy/ssh-action@v1
@@ -62,9 +62,7 @@ jobs:
           script: |
             cd /opt/trails-cool
 
-            # Merge env files: app.env (from cd-apps) + all.env (from cd-infra)
-            # all.env has both app + infra secrets
-            cp all.env .env
+            # .env was placed by the SCP step (decrypted app + infra secrets)
 
             # Login to ghcr.io (for pulling monitoring images)
             GHCR_TOKEN=$(grep DEPLOY_GHCR_TOKEN .env | cut -d= -f2-)