From c90331b1895555a5115ecca1bf19b7f19a45abff Mon Sep 17 00:00:00 2001 From: Ilia Denisov Date: Fri, 3 Jul 2026 23:37:48 +0200 Subject: [PATCH] fix(ci): prod build needs EXPORT_SIGN_KEY for compose interpolation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first v1.8.0 prod-deploy build job failed: `docker compose build` interpolates the WHOLE compose file, and the backend's :?-guarded EXPORT_SIGN_KEY — added with the finished-game export after the last prod release (v1.7.0), so the prod build never exercised it — was absent from the build job's env, tripping the guard before any image built. Prod was untouched (build-only failure: no image pushed, no deploy, no migration). Add EXPORT_SIGN_KEY (audited every :?-guarded compose var against the build job env — it was the only genuinely-missing one; TELEGRAM_MINIAPP_URL is derived in the run step). Verified by reproducing the build-job env + `docker compose config`. --- .gitea/workflows/prod-deploy.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.gitea/workflows/prod-deploy.yaml b/.gitea/workflows/prod-deploy.yaml index 3881010..a7e0b3d 100644 --- a/.gitea/workflows/prod-deploy.yaml +++ b/.gitea/workflows/prod-deploy.yaml @@ -46,6 +46,12 @@ jobs: # VITE_GATEWAY_URL omitted: the SPA is served same-origin (compose ":-" default). POSTGRES_PASSWORD: ${{ secrets.PROD_POSTGRES_PASSWORD }} GM_BASICAUTH_HASH: ${{ secrets.PROD_GM_BASICAUTH_HASH }} + # `docker compose build` interpolates the WHOLE compose file, so every :?-guarded + # runtime var must be present at build even though it is not a build-arg — incl. the + # backend's EXPORT_SIGN_KEY (added with the finished-game export after v1.7.0, which is + # why the first v1.8.0 build tripped on it). POSTGRES_PASSWORD/GM_BASICAUTH_HASH above + # are here for the same reason; DICT_VERSION + the derived Mini App URL cover the rest. + EXPORT_SIGN_KEY: ${{ secrets.PROD_EXPORT_SIGN_KEY }} # PUBLIC_BASE_URL drives the derived VK ID redirect (baked into the SPA) and the # Mini App URL; both are computed in the build step, not stored variables. PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }} -- 2.52.0