@hed-hog/cli 0.0.61 → 0.0.63

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@hed-hog/cli",
-    "version": "0.0.61",
+    "version": "0.0.63",
     "description": "HedHog CLI tool",
     "author": "HedHog",
     "private": false,

package/dist/src/templates/deployment/workflow.deploy.yml.ejs

@@ -49,6 +49,16 @@ jobs:
     name: Deploy API
     runs-on: ubuntu-latest
     needs: apply-cluster-config
+    # Required GitHub Secrets for API deployment:
+    # - DATABASE_URL: PostgreSQL connection string (format: postgresql://user:pass@host:port/dbname)
+    # - JWT_SECRET: 64-char hex string or base64 key for JWT signing
+    # - ENCRYPTION_SECRET: Base64 encoded 32-byte key for data encryption
+    # - PEPPER: Base64 encoded pepper value for password hashing
+    # - DIGITALOCEAN_ACCESS_TOKEN: DigitalOcean API token
+    #
+    # Auto-configured (via env vars in this workflow):
+    # - JWT_EXPIRES_IN: JWT expiration (currently: ${{ env.API_JWT_EXPIRES_IN }})
+    # - FRONTEND_URL: Frontend URL (currently: ${{ env.API_FRONTEND_URL }})
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -112,10 +122,42 @@ jobs:
       - name: Validate required GitHub secrets
         env:
           DATABASE_URL: ${{ secrets.DATABASE_URL }}
+          ENCRYPTION_SECRET: ${{ secrets.ENCRYPTION_SECRET }}
+          JWT_SECRET: ${{ secrets.JWT_SECRET }}
+          PEPPER: ${{ secrets.PEPPER }}
         run: |
+          MISSING_SECRETS=""
+          
+          # Check DATABASE_URL
           if [ -z "$DATABASE_URL" ]; then
             echo "::error::GitHub secret DATABASE_URL is not set. Configure it in Settings > Secrets and variables > Actions."
-            echo "::error::Expected format: postgresql://postgres:<password>@postgresql-<%= config.appName %>:5432/<%= config.appName %>"
+            echo "::error::Expected format: postgresql://postgres:<password>@postgresql-hub:5432/hub"
+            MISSING_SECRETS="$MISSING_SECRETS DATABASE_URL"
+          fi
+          
+          # Check ENCRYPTION_SECRET
+          if [ -z "$ENCRYPTION_SECRET" ]; then
+            echo "::error::GitHub secret ENCRYPTION_SECRET is not set. Configure it in Settings > Secrets and variables > Actions."
+            echo "::error::Expected format: base64 encoded 32-byte encryption key"
+            MISSING_SECRETS="$MISSING_SECRETS ENCRYPTION_SECRET"
+          fi
+          
+          # Check JWT_SECRET
+          if [ -z "$JWT_SECRET" ]; then
+            echo "::error::GitHub secret JWT_SECRET is not set. Configure it in Settings > Secrets and variables > Actions."
+            echo "::error::Expected format: 64-character hexadecimal string or base64 encoded key"
+            MISSING_SECRETS="$MISSING_SECRETS JWT_SECRET"
+          fi
+          
+          # Check PEPPER
+          if [ -z "$PEPPER" ]; then
+            echo "::error::GitHub secret PEPPER is not set. Configure it in Settings > Secrets and variables > Actions."
+            echo "::error::Expected format: base64 encoded pepper value for password hashing"
+            MISSING_SECRETS="$MISSING_SECRETS PEPPER"
+          fi
+          
+          if [ -n "$MISSING_SECRETS" ]; then
+            echo "::error::The following required secrets are missing:$MISSING_SECRETS"
             exit 1
           fi
       - name: Ensure API config exists
@@ -187,6 +229,50 @@ jobs:
             kubectl logs -l app=<%= config.appName %>-api -n ${{ env.NAMESPACE }} --tail=50 --previous 2>/dev/null || true
             exit 1
           )
+      - name: Verify API environment variables in container
+        run: |
+          echo "Waiting for pod to stabilize..."
+          sleep 5
+          
+          # Get the newest pod
+          POD_NAME=$(kubectl get pods -l app=hub-api -n ${{ env.NAMESPACE }} --sort-by=.metadata.creationTimestamp -o name | tail -n 1 | cut -d/ -f2)
+          
+          if [ -z "$POD_NAME" ]; then
+            echo "::error::No hub-api pod found in namespace ${{ env.NAMESPACE }}"
+            exit 1
+          fi
+          
+          echo "Verifying environment variables in pod: $POD_NAME"
+          echo ""
+          
+          # Required environment variables (from apps/api/.env.example)
+          REQUIRED_ENVS=("DATABASE_URL" "ENCRYPTION_SECRET" "JWT_SECRET" "PEPPER" "JWT_EXPIRES_IN" "FRONTEND_URL")
+          
+          VERIFICATION_FAILED=0
+          
+          for ENV_VAR in "${REQUIRED_ENVS[@]}"; do
+            # Check if env var is set and not empty in the container
+            ENV_VALUE=$(kubectl exec "$POD_NAME" -n ${{ env.NAMESPACE }} -- sh -c "echo \${ENV_VAR}" 2>/dev/null || echo "")
+            
+            if [ -z "$ENV_VALUE" ] || [ "$ENV_VALUE" = "\${ENV_VAR}" ]; then
+              echo "✗ FAIL: $ENV_VAR is not set or empty in the container"
+              VERIFICATION_FAILED=1
+            else
+              VALUE_LENGTH=${#ENV_VALUE}
+              echo "✓ OK: $ENV_VAR is set (${VALUE_LENGTH} chars)"
+            fi
+          done
+          
+          echo ""
+          
+          if [ $VERIFICATION_FAILED -eq 1 ]; then
+            echo "::error::One or more environment variables are missing in the API container."
+            echo "Pod environment variables (debugging info):"
+            kubectl exec "$POD_NAME" -n ${{ env.NAMESPACE }} -- env | grep -E "DATABASE_URL|ENCRYPTION_SECRET|JWT_SECRET|PEPPER|JWT_EXPIRES_IN|FRONTEND_URL" || echo "No matching vars found"
+            exit 1
+          fi
+          
+          echo "✓ All environment variables verified successfully in the container"
 <% } %>
 <% if ((config.apps || []).includes('admin')) { %>
   deploy-admin:
@@ -229,7 +315,9 @@ jobs:
           docker push ${{ env.REGISTRY }}/ci-auth-probe-admin:${{ github.run_id }}
       - name: Build Docker image
         run: |
-          docker build -t ${{ env.REGISTRY }}/<%= config.appName %>-admin:${{ github.sha }} \
+          docker build -t ${{ env.REGISTRY }}/<%= config.appName %:${{ github.sha }} \
+            --build-arg NEXT_PUBLIC_API_BASE_URL=${{ env.ADMIN_API_BASE_URL }} \
+            --build-arg NEXT_PUBLIC_API_URL=${{ env.ADMIN_API_URL }} \
             -f apps/admin/Dockerfile .
       - name: Push Docker image (sha)
         run: |