underpost 3.2.2 → 3.2.4

package/.github/workflows/publish.ci.yml

@@ -3,17 +3,27 @@ on:
   push:
     tags:
       - 'v*'
+permissions:
+  contents: write
+  packages: write
+  id-token: write
 jobs:
   build-and-publish:
     # prevents this action from running on forks
     if: github.repository == 'underpostnet/pwa-microservices-template'
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
+      packages: write
       id-token: write
     steps:
       - uses: actions/checkout@v6
 
+      - name: Install required packages
+        run: |
+          sudo apt-get update -y
+          sudo apt-get install -y sudo tar gzip bzip2 git curl
+
       - uses: actions/setup-node@v6
         with:
           node-version: '24.x'
@@ -27,12 +37,21 @@ jobs:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npm publish --provenance --access public
 
+      - name: Dispatch release CD
+        run: |
+          curl -s -f -X POST \
+            -H "Accept: application/vnd.github.v3+json" \
+            -H "Authorization: token ${{ secrets.GIT_AUTH_TOKEN }}" \
+            "https://api.github.com/repos/underpostnet/pwa-microservices-template/actions/workflows/release.cd.yml/dispatches" \
+            -d '{"ref":"master"}'
+
   build-and-publish-ghpkg:
     # prevents this action from running on forks
     if: github.repository == 'underpostnet/pwa-microservices-template-ghpkg'
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
+      packages: write
       id-token: write
     steps:
       - uses: actions/checkout@v6
@@ -66,9 +85,3 @@ jobs:
           npm publish
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GIT_AUTH_TOKEN }}
-
-  # Release deploy — triggers release.cd.yml after Docker build succeeds
-  deploy-release:
-    needs: build-and-publish
-    uses: ./.github/workflows/release.cd.yml
-    secrets: inherit

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 ## 2026-04-15
 
+### cli-cron
+
+- Update underpost container environment path for volume mount ([8fdfb5416](https://github.com/underpostnet/engine/commit/8fdfb54165f4ef7379fccbeb20e5c476320bc1f6))
+
+### github-actions
+
+- Add dispatch step for release CD in publish workflow ([8dc0e3ccd](https://github.com/underpostnet/engine/commit/8dc0e3ccd1a578f776edf215428d08640b44c3d1))
+
+## New release v:3.2.3 (2026-04-15)
+
+### cli-cron
+
+- Remove is-inside-container dependency and implement isInsideContainer method in env module ([79d39ece0](https://github.com/underpostnet/engine/commit/79d39ece0db1f3acb65af22e3bc7f7c6a66487a9))
+
+### github-actions
+
+- Ensure deploy-release job runs only on successful build-and-publish ([08ba04632](https://github.com/underpostnet/engine/commit/08ba0463263f6cb2b6c14a6bd56e547c152a0a3a))
+
+## New release v:3.2.2 (2026-04-15)
+
 ### docker-image
 
 - Remove unnecessary directory creation and volume declaration for working directory in Dockerfile ([84f7f8950](https://github.com/underpostnet/engine/commit/84f7f8950d45512b6177c7523e4d278f2db25ef4))

package/CLI-HELP.md

@@ -1,4 +1,4 @@
-## underpost ci/cd cli v3.2.2
+## underpost ci/cd cli v3.2.4
 
 ### Usage: `underpost [options] [command]`
   ```
@@ -321,7 +321,7 @@ Manages Underpost configurations using various operators.
 
 Arguments:
   operator                 The configuration operation to perform. Options: set,
-                           delete, get, list, clean.
+                           delete, get, list, clean, isInsideContainer.
   key                      Optional: The specific configuration key to manage.
   value                    Optional: The value to set for the configuration key.
 
@@ -562,6 +562,8 @@ Options:
                                       environment file.
   --create-from-env                   Creates secrets from container environment
                                       variables (envFrom: secretRef).
+  --global-clean                      Removes all filesystem traces of secrets
+                                      (engine-private, .env, conf cache).
   --list                              Lists all available secrets for the
                                       platform.
   -h, --help                          display help for command
@@ -685,6 +687,7 @@ Options:
   --instances  Apply to instance data collection
   --generate   Generate cluster metadata
   --itc        Apply under container execution context
+  --dev        Sets the development cli context
   -h, --help   display help for command
  
 ```

package/README.md

@@ -16,7 +16,7 @@
 
 <div align="center">
 
-[![Node.js CI](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml) [![Test](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml) [![Downloads](https://img.shields.io/npm/dm/underpost.svg)](https://www.npmjs.com/package/underpost) [![Socket Badge](https://socket.dev/api/badge/npm/package/underpost/3.2.2)](https://socket.dev/npm/package/underpost/overview/3.2.2) [![Coverage Status](https://coveralls.io/repos/github/underpostnet/engine/badge.svg?branch=master)](https://coveralls.io/github/underpostnet/engine?branch=master) [![Version](https://img.shields.io/npm/v/underpost.svg)](https://www.npmjs.org/package/underpost) [![License](https://img.shields.io/npm/l/underpost.svg)](https://www.npmjs.com/package/underpost)
+[![Node.js CI](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml) [![Test](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml) [![Downloads](https://img.shields.io/npm/dm/underpost.svg)](https://www.npmjs.com/package/underpost) [![Socket Badge](https://socket.dev/api/badge/npm/package/underpost/3.2.4)](https://socket.dev/npm/package/underpost/overview/3.2.4) [![Coverage Status](https://coveralls.io/repos/github/underpostnet/engine/badge.svg?branch=master)](https://coveralls.io/github/underpostnet/engine?branch=master) [![Version](https://img.shields.io/npm/v/underpost.svg)](https://www.npmjs.org/package/underpost) [![License](https://img.shields.io/npm/l/underpost.svg)](https://www.npmjs.com/package/underpost)
 
 </div>
 
@@ -61,7 +61,7 @@ npm run dev
 <a target="_top" href="https://www.nexodev.org/docs?cid=src">See Docs here.</a>
 
 <!-- cli-index-start -->
-## underpost ci/cd cli v3.2.2
+## underpost ci/cd cli v3.2.4
 
 ### Usage: `underpost [options] [command]`
   ```

package/manifests/cronjobs/dd-cron/dd-cron-backup.yaml

@@ -23,7 +23,7 @@ spec:
         spec:
           containers:
             - name: dd-cron-backup
-              image: underpost/underpost-engine:v3.2.2
+              image: underpost/underpost-engine:v3.2.4
               command:
                 - /bin/sh
                 - -c
@@ -35,9 +35,8 @@ spec:
               volumeMounts:
                 - mountPath: /home/dd/engine
                   name: underpost-cron-container-volume
-                - mountPath: /usr/lib/node_modules/underpost/.env
+                - mountPath: /usr/lib/node_modules/underpost
                   name: underpost-share-env
-                  subPath: .env
           volumes:
             - hostPath:
                 path: /home/dd/engine

package/manifests/cronjobs/dd-cron/dd-cron-dns.yaml

@@ -23,7 +23,7 @@ spec:
         spec:
           containers:
             - name: dd-cron-dns
-              image: underpost/underpost-engine:v3.2.2
+              image: underpost/underpost-engine:v3.2.4
               command:
                 - /bin/sh
                 - -c
@@ -35,9 +35,8 @@ spec:
               volumeMounts:
                 - mountPath: /home/dd/engine
                   name: underpost-cron-container-volume
-                - mountPath: /usr/lib/node_modules/underpost/.env
+                - mountPath: /usr/lib/node_modules/underpost
                   name: underpost-share-env
-                  subPath: .env
           volumes:
             - hostPath:
                 path: /home/dd/engine

package/manifests/deployment/dd-default-development/deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-blue
-          image: localhost/rockylinux9-underpost:v3.2.2
+          image: localhost/rockylinux9-underpost:v3.2.4
           #          resources:
           #            requests:
           #              memory: "124Ki"
@@ -100,7 +100,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-green
-          image: localhost/rockylinux9-underpost:v3.2.2
+          image: localhost/rockylinux9-underpost:v3.2.4
           #          resources:
           #            requests:
           #              memory: "124Ki"

package/manifests/deployment/dd-test-development/deployment.yaml

@@ -20,7 +20,7 @@ spec:
     spec:
       containers:
         - name: dd-test-development-blue
-          image: localhost/rockylinux9-underpost:v3.2.2
+          image: localhost/rockylinux9-underpost:v3.2.4
           envFrom:
             - secretRef:
                 name: underpost-config
@@ -112,7 +112,7 @@ spec:
     spec:
       containers:
         - name: dd-test-development-green
-          image: localhost/rockylinux9-underpost:v3.2.2
+          image: localhost/rockylinux9-underpost:v3.2.4
           envFrom:
             - secretRef:
                 name: underpost-config

package/package.json

@@ -2,7 +2,7 @@
     "type": "module",
     "main": "src/index.js",
     "name": "underpost",
-    "version": "3.2.2",
+    "version": "3.2.4",
     "description": "pwa api rest template",
     "scripts": {
         "start": "node --max-old-space-size=8192 src/server",
@@ -86,7 +86,6 @@
         "http-proxy-middleware": "^3.0.5",
         "ignore-walk": "^8.0.0",
         "iovalkey": "^0.3.3",
-        "is-inside-container": "^1.0.0",
         "json-colorizer": "^3.0.1",
         "jsonwebtoken": "^9.0.3",
         "mariadb": "^3.2.2",

package/src/cli/db.js

@@ -14,7 +14,6 @@ import { DataBaseProvider } from '../db/DataBaseProvider.js';
 import { loadReplicas, pathPortAssignmentFactory, loadCronDeployEnv } from '../server/conf.js';
 import Underpost from '../index.js';
 import { timer } from '../client/components/core/CommonJs.js';
-import isInsideContainer from 'is-inside-container';
 const logger = loggerFactory(import.meta);
 
 /**
@@ -582,10 +581,9 @@ class UnderpostDB {
         repoBackup: false,
       },
     ) {
-      // Ensure engine-private is available (clone ephemerally if inside a deployment
+      // Ensure engine-private is available (clone if inside a deployment
       // container where globalSecretClean has already removed it).
       const firstDeployId = deployList !== 'dd' ? deployList.split(',')[0].trim() : '';
-      const { ephemeral } = Underpost.repo.privateEngineRepoFactory(firstDeployId || undefined);
       try {
         loadCronDeployEnv();
         const newBackupTimestamp = new Date().getTime();
@@ -948,11 +946,6 @@ class UnderpostDB {
       } catch (error) {
         logger.error('Database operation failed', { error: error.message });
         throw error;
-      } finally {
-        if (ephemeral && isInsideContainer()) {
-          Underpost.repo.cleanupPrivateEngineRepo();
-          Underpost.env.clean();
-        }
       }
     },
 
@@ -965,6 +958,8 @@ class UnderpostDB {
      * @param {string} [deployId=process.env.DEFAULT_DEPLOY_ID] - The deployment ID.
      * @param {string} [host=process.env.DEFAULT_DEPLOY_HOST] - The host identifier.
      * @param {string} [path=process.env.DEFAULT_DEPLOY_PATH] - The path identifier.
+     * @param {object} [options] - Options.
+     * @param {boolean} [options.dev=false] - Development mode flag.
      * @return {Promise<void>} Resolves when metadata creation is complete.
      * @throws {Error} If database configuration is invalid or connection fails.
      */
@@ -972,8 +967,8 @@ class UnderpostDB {
       deployId = process.env.DEFAULT_DEPLOY_ID,
       host = process.env.DEFAULT_DEPLOY_HOST,
       path = process.env.DEFAULT_DEPLOY_PATH,
+      options = { dev: false },
     ) {
-      const { ephemeral } = Underpost.repo.privateEngineRepoFactory(deployId || undefined);
       try {
         loadCronDeployEnv();
         deployId = deployId ? deployId : process.env.DEFAULT_DEPLOY_ID;
@@ -1146,11 +1141,6 @@ class UnderpostDB {
       } catch (error) {
         logger.error('Cluster metadata creation failed', { error: error.message });
         throw error;
-      } finally {
-        if (ephemeral && isInsideContainer()) {
-          Underpost.repo.cleanupPrivateEngineRepo();
-          Underpost.env.clean();
-        }
       }
     },
 
@@ -1165,6 +1155,7 @@ class UnderpostDB {
      * @param {string} [options.hosts=''] - Comma-separated list of hosts to filter.
      * @param {string} [options.paths=''] - Comma-separated list of paths to filter.
      * @param {boolean} [options.dryRun=false] - If true, only reports what would be deleted.
+     * @param {boolean} [options.dev=false] - Development mode flag.
      * @return {Promise<void>} Resolves when clean operation is complete.
      */
     async cleanFsCollection(
@@ -1173,10 +1164,10 @@ class UnderpostDB {
         hosts: '',
         paths: '',
         dryRun: false,
+        dev: false,
       },
     ) {
       const firstDeployId = deployList !== 'dd' ? deployList.split(',')[0].trim() : '';
-      const { ephemeral } = Underpost.repo.privateEngineRepoFactory(firstDeployId || undefined);
       try {
         loadCronDeployEnv();
         if (deployList === 'dd') deployList = fs.readFileSync(`./engine-private/deploy/dd.router`, 'utf8');
@@ -1386,11 +1377,6 @@ class UnderpostDB {
       } catch (error) {
         logger.error('File collection cleanup failed', { error: error.message });
         throw error;
-      } finally {
-        if (ephemeral && isInsideContainer()) {
-          Underpost.repo.cleanupPrivateEngineRepo();
-          Underpost.env.clean();
-        }
       }
     },
 
@@ -1410,6 +1396,7 @@ class UnderpostDB {
      * @param {boolean} [options.export=false] - Export metadata to backup.
      * @param {boolean} [options.instances=false] - Process instances collection.
      * @param {boolean} [options.crons=false] - Process crons collection.
+     * @param {boolean} [options.dev=false] - Development mode flag.
      * @return {Promise<void>} Resolves when backup operation is complete.
      */
     async clusterMetadataBackupCallback(
@@ -1423,9 +1410,9 @@ class UnderpostDB {
         export: false,
         instances: false,
         crons: false,
+        dev: false,
       },
     ) {
-      const { ephemeral } = Underpost.repo.privateEngineRepoFactory(deployId || undefined);
       try {
         loadCronDeployEnv();
         deployId = deployId ? deployId : process.env.DEFAULT_DEPLOY_ID;
@@ -1492,11 +1479,6 @@ class UnderpostDB {
       } catch (error) {
         logger.error('Cluster metadata backup operation failed', { error: error.message });
         throw error;
-      } finally {
-        if (ephemeral && isInsideContainer()) {
-          Underpost.repo.cleanupPrivateEngineRepo();
-          Underpost.env.clean();
-        }
       }
     },
   };

package/src/cli/env.js

@@ -153,6 +153,16 @@ class UnderpostRootEnv {
       const envPath = `${exeRootPath}/.env`;
       fs.removeSync(envPath);
     },
+    /**
+     * @method isInsideContainer
+     * @description Detects whether the current process is running inside a container.
+     * Checks for Kubernetes service injection or Docker's .dockerenv marker.
+     * @returns {boolean} True if running inside a container.
+     * @memberof UnderpostEnv
+     */
+    isInsideContainer() {
+      return !!process.env.KUBERNETES_SERVICE_HOST || fs.existsSync('/.dockerenv');
+    },
   };
 }
 

package/src/cli/index.js

@@ -338,9 +338,11 @@ program
   .option('--init', 'Initializes the secrets platform environment.')
   .option('--create-from-file <path-env-file>', 'Creates secrets from a specified environment file.')
   .option('--create-from-env', 'Creates secrets from container environment variables (envFrom: secretRef).')
+  .option('--global-clean', 'Removes all filesystem traces of secrets (engine-private, .env, conf cache).')
   .option('--list', 'Lists all available secrets for the platform.')
   .description(`Manages secrets for various platforms.`)
   .action((...args) => {
+    if (args[1].globalClean) return Underpost.secret.globalSecretClean();
     if (args[1].createFromFile) return Underpost.secret[args[0]].createFromEnvFile(args[1].createFromFile);
     if (args[1].createFromEnv) return Underpost.secret[args[0]].createFromContainerEnv();
     if (args[1].list) return Underpost.secret[args[0]].list();
@@ -442,6 +444,7 @@ program
   .option('--instances', 'Apply to instance data collection')
   .option('--generate', 'Generate cluster metadata')
   .option('--itc', 'Apply under container execution context')
+  .option('--dev', 'Sets the development cli context')
   .description('Manages cluster metadata operations, including import and export.')
   .action(Underpost.db.clusterMetadataBackupCallback);
 

package/src/cli/repository.js

@@ -1501,6 +1501,7 @@ Prevent build private config repo.`,
             `git config --global --add safe.directory '${siteRoot}' 2>/dev/null || true`,
             `cd '${siteRoot}' && git add -A && git commit -m 'backup $(date -u +%Y-%m-%dT%H:%M:%SZ)' || true`,
             `cd '${siteRoot}' && underpost push . ${githubUsername}/${repoName}`,
+            `cd /home/dd/engine && node bin secret underpost --global-clean`,
           ].join(' && ');
 
           try {
@@ -1517,38 +1518,41 @@ Prevent build private config repo.`,
     /**
      * Clones the deploy-specific private repository into `./engine-private`
      * when it does not already exist on disk.  Returns `{ ephemeral: true }`
-     * when a fresh clone was performed so the caller can remove it after use,
-     * or `{ ephemeral: false }` when the directory was already present (host,
-     * cron hostPath mount, or prior build step).
+     * If `./engine-private` already exists, the call is a no-op unless
+     * `options.force` is `true`, in which case the directory is removed and
+     * re-cloned.
      *
      * @param {string} [deployId] - Deploy ID (e.g. `dd-core`) used to derive
      *        the repo name `engine-{component}-private`.  Falls back to
-     *        `process.env.DEFAULT_DEPLOY_ID`.
-     * @returns {{ ephemeral: boolean }}
+     *        `process.env.DEFAULT_DEPLOY_ID`.  When neither is available the
+     *        default repo name `engine-private` is used.
+     * @param {object} [options]
+     * @param {boolean} [options.force=false] - Remove existing `engine-private`
+     *        and re-clone.
      * @memberof UnderpostRepository
      */
-    privateEngineRepoFactory(deployId) {
-      if (fs.existsSync('./engine-private')) return { ephemeral: false };
+    privateEngineRepoFactory(deployId, options = { force: false }) {
+      if (fs.existsSync('./engine-private') && !options.force) return;
 
-      const effectiveDeployId = deployId || process.env.DEFAULT_DEPLOY_ID;
-      if (!effectiveDeployId) {
-        throw new Error('privateEngineRepoFactory: no deployId provided and DEFAULT_DEPLOY_ID not set');
+      if (options.force && fs.existsSync('./engine-private')) {
+        fs.removeSync('./engine-private');
+        logger.info('engine-private removed (force re-clone)');
       }
+
+      const effectiveDeployId = deployId || process.env.DEFAULT_DEPLOY_ID;
+
       const username = process.env.GITHUB_USERNAME;
       if (!username) {
         throw new Error('privateEngineRepoFactory: GITHUB_USERNAME not set');
       }
 
-      const component = effectiveDeployId.split('-')[1];
-      const repoName = `engine-${component}-private`;
-      logger.info(`engine-private missing — cloning ${username}/${repoName} (ephemeral)`);
+      const repoName = effectiveDeployId ? `engine-${effectiveDeployId.split('-')[1]}-private` : 'engine-private';
+      logger.info(`engine-private missing — cloning ${username}/${repoName}`);
       shellExec(`underpost clone ${username}/${repoName}`);
       if (!fs.existsSync(`./${repoName}`)) {
         throw new Error(`privateEngineRepoFactory: clone failed for ${username}/${repoName}`);
       }
-      shellExec(`mv ./${repoName} ./engine-private`);
-
-      return { ephemeral: true };
+      if (repoName !== 'engine-private') shellExec(`mv ./${repoName} ./engine-private`);
     },
 
     /**

package/src/cli/run.js

@@ -699,6 +699,10 @@ echo -e "[code]\nname=Visual Studio Code\nbaseurl=https://packages.microsoft.com
       );
 
       if (isDeployRunnerContext(path, options)) {
+        // Backup app/services repositories with repo-backup configured
+        shellExec(
+          `${baseCommand} db ${deployId} ${clusterFlag} --repo-backup --dev --primary-pod --git --force-clone --preserveUUID ${options.namespace ? ` --ns ${options.namespace}` : ''}`,
+        );
         shellExec(
           `${baseCommand} deploy${clusterFlag}${cmdString} --replicas ${replicas} --disable-update-proxy ${deployId} ${env} --versions ${versions}${
             options.namespace ? ` --namespace ${options.namespace}` : ''

package/src/index.js

@@ -44,7 +44,7 @@ class Underpost {
    * @type {String}
    * @memberof Underpost
    */
-  static version = 'v3.2.2';
+  static version = 'v3.2.4';
 
   /**
    * Required Node.js major version

package/src/server/backup.js

@@ -38,59 +38,54 @@ class BackUp {
    */
   static callback = async function (deployList, options = { git: false }) {
     const firstDeployId = deployList && deployList !== 'dd' ? deployList.split(',')[0].trim() : '';
-    const { ephemeral } = Underpost.repo.privateEngineRepoFactory(firstDeployId || undefined);
-    try {
-      loadCronDeployEnv();
-      if ((!deployList || deployList === 'dd') && fs.existsSync(`./engine-private/deploy/dd.router`))
-        deployList = fs.readFileSync(`./engine-private/deploy/dd.router`, 'utf8').trim();
+    loadCronDeployEnv();
+    if ((!deployList || deployList === 'dd') && fs.existsSync(`./engine-private/deploy/dd.router`))
+      deployList = fs.readFileSync(`./engine-private/deploy/dd.router`, 'utf8').trim();
 
-      logger.info('init backups callback', deployList);
-      await logger.setUpInfo();
+    logger.info('init backups callback', deployList);
+    await logger.setUpInfo();
 
-      const clusterFlag = options.k3s ? ' --k3s' : options.kind ? ' --kind' : options.kubeadm ? ' --kubeadm' : '';
+    const clusterFlag = options.k3s ? ' --k3s' : options.kind ? ' --kind' : options.kubeadm ? ' --kubeadm' : '';
 
-      for (const _deployId of deployList.split(',')) {
-        const deployId = _deployId.trim();
-        if (!deployId) continue;
+    for (const _deployId of deployList.split(',')) {
+      const deployId = _deployId.trim();
+      if (!deployId) continue;
 
-        const dbCommand = `node bin db ${options.git ? '--git --force-clone ' : ''}--export --primary-pod${clusterFlag} ${deployId}`;
-        const repoCommand = `node bin db --repo-backup${clusterFlag} ${deployId}`;
+      const dbCommand = `node bin db ${options.git ? '--git --force-clone ' : ''}--export --primary-pod${clusterFlag} ${deployId}`;
+      const repoCommand = `node bin db --repo-backup${clusterFlag} ${deployId}`;
 
-        // Pass GITHUB_TOKEN and GITHUB_USERNAME ephemerally through the SSH command
-        // so git operations can push backups without relying on host env files.
-        const envPrefix = [
-          process.env.GITHUB_TOKEN ? `GITHUB_TOKEN=${process.env.GITHUB_TOKEN}` : '',
-          process.env.GITHUB_USERNAME ? `GITHUB_USERNAME=${process.env.GITHUB_USERNAME}` : '',
-        ]
-          .filter(Boolean)
-          .join(' ');
-        const prefixCmd = (cmd) => (envPrefix ? `${envPrefix} ${cmd}` : cmd);
+      // Pass GITHUB_TOKEN and GITHUB_USERNAME ephemerally through the SSH command
+      // so git operations can push backups without relying on host env files.
+      const envPrefix = [
+        process.env.GITHUB_TOKEN ? `GITHUB_TOKEN=${process.env.GITHUB_TOKEN}` : '',
+        process.env.GITHUB_USERNAME ? `GITHUB_USERNAME=${process.env.GITHUB_USERNAME}` : '',
+      ]
+        .filter(Boolean)
+        .join(' ');
+      const prefixCmd = (cmd) => (envPrefix ? `${envPrefix} ${cmd}` : cmd);
 
-        try {
-          logger.info('Executing database export via SSH for', deployId);
-          await Underpost.ssh.sshRemoteRunner(prefixCmd(dbCommand), {
-            remote: true,
-            useSudo: true,
-            cd: '/home/dd/engine',
-          });
-        } catch (err) {
-          logger.error(`Error during database export for ${deployId}:`, err);
-        }
+      try {
+        logger.info('Executing database export via SSH for', deployId);
+        await Underpost.ssh.sshRemoteRunner(prefixCmd(dbCommand), {
+          remote: true,
+          useSudo: true,
+          cd: '/home/dd/engine',
+        });
+      } catch (err) {
+        logger.error(`Error during database export for ${deployId}:`, err);
+      }
 
-        // Repository backup: Cron container → SSH to host → host finds pod → kubectl exec git backup
-        try {
-          logger.info('Executing repository backup via SSH for', deployId);
-          await Underpost.ssh.sshRemoteRunner(prefixCmd(repoCommand), {
-            remote: true,
-            useSudo: true,
-            cd: '/home/dd/engine',
-          });
-        } catch (err) {
-          logger.error(`Error during repository backup for ${deployId}:`, err);
-        }
+      // Repository backup: Cron container → SSH to host → host finds pod → kubectl exec git backup
+      try {
+        logger.info('Executing repository backup via SSH for', deployId);
+        await Underpost.ssh.sshRemoteRunner(prefixCmd(repoCommand), {
+          remote: true,
+          useSudo: true,
+          cd: '/home/dd/engine',
+        });
+      } catch (err) {
+        logger.error(`Error during repository backup for ${deployId}:`, err);
       }
-    } finally {
-      if (ephemeral) Underpost.repo.cleanupPrivateEngineRepo();
     }
   };
 }

package/src/server/cron.js

@@ -16,7 +16,7 @@ const volumeHostPath = '/home/dd';
 const enginePath = '/home/dd/engine';
 const cronVolumeName = 'underpost-cron-container-volume';
 const shareEnvVolumeName = 'underpost-share-env';
-const underpostContainerEnvPath = '/usr/lib/node_modules/underpost/.env';
+const underpostContainerEnvDir = '/usr/lib/node_modules/underpost';
 
 /**
  * Generates a Kubernetes CronJob YAML manifest string.
@@ -105,9 +105,8 @@ spec:
               volumeMounts:
                 - mountPath: ${enginePath}
                   name: ${cronVolumeName}
-                - mountPath: ${underpostContainerEnvPath}
+                - mountPath: ${underpostContainerEnvDir}
                   name: ${shareEnvVolumeName}
-                  subPath: .env
           volumes:
             - hostPath:
                 path: ${enginePath}

package/src/server/start.js

@@ -9,7 +9,6 @@ import { awaitDeployMonitor } from './conf.js';
 import { actionInitLog, loggerFactory } from './logger.js';
 import { shellCd, shellExec } from './process.js';
 import Underpost from '../index.js';
-import isInsideContainer from 'is-inside-container';
 const logger = loggerFactory(import.meta);
 
 /**
@@ -197,7 +196,7 @@ class UnderpostStartUp {
       shellExec(`node bin env ${deployId} ${env}`);
       shellExec(`npm ${runCmd} ${deployId}`, { async: true });
       await awaitDeployMonitor(true);
-      if (env === 'production' && isInsideContainer()) Underpost.secret.globalSecretClean();
+      if (env === 'production' && Underpost.env.isInsideContainer()) Underpost.secret.globalSecretClean();
       Underpost.env.set('container-status', `${deployId}-${env}-running-deployment`);
     },
   };