jcoakley/dev1
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pipeline build v30 - added GCP secrets to script

Browse Source
This commit is contained in:
Josh 2025-07-31 16:12:54 +00:00
parent f61c19a416
commit 8a84621b5a
1 changed files with 28 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
.woodpecker.yml
View File

@ -27,13 +27,36 @@ steps:
-i ~/.ssh/id_ed25519 \
jcoakley@10.128.0.12 \
'set -euo pipefail; \
IMG_TAG=$(gcloud secrets versions access latest --secret=IMG_TAG --project=aptivaai-dev); \
cd /home/jcoakley/aptiva-staging-app; \
# ── Pull canonical IMG_TAG ────────────────────────────────
IMG_TAG=$(gcloud secrets versions access latest \
--secret=IMG_TAG --project=aptivaai-dev); \
export IMG_TAG; \
echo "📦 IMG_TAG=$IMG_TAG"; \
cd /home/jcoakley/aptiva-staging-app; \
echo "IMG_TAG = $IMG_TAG"; \
sudo --preserve-env=IMG_TAG docker compose pull; \
sudo --preserve-env=IMG_TAG docker compose up -d --force-recreate --remove-orphans; \
# ── Inject sensitive secrets runtime-only ─────────────────
ENV=staging; \
PROJECT=aptivaai-dev; \
SECRETS=( \
JWT_SECRET OPENAI_API_KEY ONET_USERNAME ONET_PASSWORD \
STRIPE_SECRET_KEY STRIPE_PUBLISHABLE_KEY STRIPE_WH_SECRET \
STRIPE_PRICE_PREMIUM_MONTH STRIPE_PRICE_PREMIUM_YEAR \
STRIPE_PRICE_PRO_MONTH STRIPE_PRICE_PRO_YEAR \
DB_HOST DB_PORT DB_USER DB_PASSWORD \
TWILIO_ACCOUNT_SID TWILIO_AUTH_TOKEN TWILIO_MESSAGING_SERVICE_SID \
); \
for S in "${SECRETS[@]}"; do \
export "$S"="$(gcloud secrets versions access latest \
--secret="${S}_${ENV}" --project="$PROJECT")"; \
done; \
export FROM_SECRETS_MANAGER=true; \
# ── Compose with env preserved ────────────────────────────
preserve=IMG_TAG,FROM_SECRETS_MANAGER,$(IFS=,; echo "${SECRETS[*]}"); \
echo "🚀 docker compose up with envs: $preserve"; \
sudo --preserve-env="$preserve" docker compose pull; \
sudo --preserve-env="$preserve" docker compose up -d --force-recreate --remove-orphans; \
echo "✅ Staging stack refreshed with tag $IMG_TAG"'
secrets: