trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix SCP path for decrypted secrets in CD workflows

Browse source 
Write decrypted env files to infrastructure/ instead of /tmp/ so
strip_components: 1 correctly places them on the server.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ullrich Schäfer 2026-03-27 17:43:30 +01:00
parent 6e39d23dd4
commit e880e3e9d9
No known key found for this signature in database
GPG key ID: A32FF691A0F752D9
2 changed files with 11 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

10
.github/workflows/cd-apps.yml vendored
View file

@ -64,9 +64,9 @@ jobs:
run: | run: |
curl -sLO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.linux.amd64 curl -sLO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.linux.amd64
chmod +x sops-v3.9.4.linux.amd64 chmod +x sops-v3.9.4.linux.amd64
SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.app.env > /tmp/app.env SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.app.env > infrastructure/app.env
echo "SENTRY_RELEASE=${{ github.sha }}" >> /tmp/app.env echo "SENTRY_RELEASE=${{ github.sha }}" >> infrastructure/app.env
echo "DOMAIN=trails.cool" >> /tmp/app.env echo "DOMAIN=trails.cool" >> infrastructure/app.env
- name: Copy files to server - name: Copy files to server
uses: appleboy/scp-action@v1 uses: appleboy/scp-action@v1
@ -84,9 +84,9 @@ jobs:
host: ${{ secrets.DEPLOY_HOST }} host: ${{ secrets.DEPLOY_HOST }}
username: root username: root
key: ${{ secrets.DEPLOY_SSH_KEY }} key: ${{ secrets.DEPLOY_SSH_KEY }}
source: "/tmp/app.env" source: "infrastructure/app.env"
target: /opt/trails-cool target: /opt/trails-cool
strip_components: 2 strip_components: 1
- name: Deploy via SSH - name: Deploy via SSH
uses: appleboy/ssh-action@v1 uses: appleboy/ssh-action@v1

14
.github/workflows/cd-infra.yml vendored
View file

@ -29,9 +29,9 @@ jobs:
curl -sLO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.linux.amd64 curl -sLO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.linux.amd64
chmod +x sops-v3.9.4.linux.amd64 chmod +x sops-v3.9.4.linux.amd64
# Merge app + infra secrets into one .env for docker-compose # Merge app + infra secrets into one .env for docker-compose
SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.app.env > /tmp/all.env SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.app.env > infrastructure/.env
SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.infra.env >> /tmp/all.env SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.infra.env >> infrastructure/.env
echo "DOMAIN=trails.cool" >> /tmp/all.env echo "DOMAIN=trails.cool" >> infrastructure/.env
- name: Copy configs to server - name: Copy configs to server
uses: appleboy/scp-action@v1 uses: appleboy/scp-action@v1
@ -49,9 +49,9 @@ jobs:
host: ${{ secrets.DEPLOY_HOST }} host: ${{ secrets.DEPLOY_HOST }}
username: root username: root
key: ${{ secrets.DEPLOY_SSH_KEY }} key: ${{ secrets.DEPLOY_SSH_KEY }}
source: "/tmp/all.env" source: "infrastructure/.env"
target: /opt/trails-cool target: /opt/trails-cool
strip_components: 2 strip_components: 1
- name: Deploy via SSH - name: Deploy via SSH
uses: appleboy/ssh-action@v1 uses: appleboy/ssh-action@v1
@ -62,9 +62,7 @@ jobs:
script: | script: |
cd /opt/trails-cool cd /opt/trails-cool
# Merge env files: app.env (from cd-apps) + all.env (from cd-infra) # .env was placed by the SCP step (decrypted app + infra secrets)
# all.env has both app + infra secrets
cp all.env .env
# Login to ghcr.io (for pulling monitoring images) # Login to ghcr.io (for pulling monitoring images)
GHCR_TOKEN=$(grep DEPLOY_GHCR_TOKEN .env | cut -d= -f2-) GHCR_TOKEN=$(grep DEPLOY_GHCR_TOKEN .env | cut -d= -f2-)