From b72e5f2ebe8fb673dd691719db18b284fa26ce2c Mon Sep 17 00:00:00 2001
From: Josh <jcoakley@aptivaai.com>
Date: Thu, 31 Jul 2025 17:33:19 +0000
Subject: [PATCH] pipline build v51.  injecting ALL secrets

---
 .woodpecker.yml | 29 ++++++++++++++++++++++-------
 1 file changed, 22 insertions(+), 7 deletions(-)

diff --git a/.woodpecker.yml b/.woodpecker.yml
index eb8d4e1..968fdec 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -32,16 +32,31 @@ steps:
             -i ~/.ssh/id_ed25519 \
             jcoakley@10.128.0.12 \
             'set -euo pipefail; \
-             IMG_TAG=$(gcloud secrets versions access latest --secret=IMG_TAG --project=aptivaai-dev); \
+             ENV=dev; \
+             PROJECT=aptivaai-dev; \
+             IMG_TAG=$(gcloud secrets versions access latest --secret=IMG_TAG --project=$PROJECT); \
              export IMG_TAG; \
-             JWT_SECRET=$(gcloud secrets versions access latest --secret=JWT_SECRET --project=aptivaai-dev); \
-             export JWT_SECRET; \
              echo "📦 IMG_TAG=$IMG_TAG"; \
-             echo "🔐 JWT_SECRET length = $(echo -n \"$JWT_SECRET\" | wc -c)"; \
+
+             # ── Pull all secrets ────────────────────────────────────────
+             for S in JWT_SECRET OPENAI_API_KEY ONET_USERNAME ONET_PASSWORD \
+                      STRIPE_SECRET_KEY STRIPE_PUBLISHABLE_KEY STRIPE_WH_SECRET \
+                      STRIPE_PRICE_PREMIUM_MONTH STRIPE_PRICE_PREMIUM_YEAR \
+                      STRIPE_PRICE_PRO_MONTH STRIPE_PRICE_PRO_YEAR \
+                      DB_HOST DB_PORT DB_USER DB_PASSWORD \
+                      TWILIO_ACCOUNT_SID TWILIO_AUTH_TOKEN TWILIO_MESSAGING_SERVICE_SID; do \
+               export "$S"="$(gcloud secrets versions access latest --secret=${S}_${ENV} --project=$PROJECT)"; \
+               echo "🔐 $S length = $(echo -n "${!S}" | wc -c)"; \
+             done; \
+             export FROM_SECRETS_MANAGER=true; \
+
              cd /home/jcoakley/aptiva-staging-app; \
-             echo "IMG_TAG = $IMG_TAG"; \
-             sudo --preserve-env=IMG_TAG,JWT_SECRET docker compose pull; \
-             sudo --preserve-env=IMG_TAG,JWT_SECRET docker compose up -d --force-recreate --remove-orphans; \
+             echo "→ Pulling containers"; \
+             sudo --preserve-env=IMG_TAG,FROM_SECRETS_MANAGER,JWT_SECRET,OPENAI_API_KEY,ONET_USERNAME,ONET_PASSWORD,STRIPE_SECRET_KEY,STRIPE_PUBLISHABLE_KEY,STRIPE_WH_SECRET,STRIPE_PRICE_PREMIUM_MONTH,STRIPE_PRICE_PREMIUM_YEAR,STRIPE_PRICE_PRO_MONTH,STRIPE_PRICE_PRO_YEAR,DB_HOST,DB_PORT,DB_USER,DB_PASSWORD,TWILIO_ACCOUNT_SID,TWILIO_AUTH_TOKEN,TWILIO_MESSAGING_SERVICE_SID \
+               docker compose pull; \
+             echo "→ Recreating services"; \
+             sudo --preserve-env=IMG_TAG,FROM_SECRETS_MANAGER,JWT_SECRET,OPENAI_API_KEY,ONET_USERNAME,ONET_PASSWORD,STRIPE_SECRET_KEY,STRIPE_PUBLISHABLE_KEY,STRIPE_WH_SECRET,STRIPE_PRICE_PREMIUM_MONTH,STRIPE_PRICE_PREMIUM_YEAR,STRIPE_PRICE_PRO_MONTH,STRIPE_PRICE_PRO_YEAR,DB_HOST,DB_PORT,DB_USER,DB_PASSWORD,TWILIO_ACCOUNT_SID,TWILIO_AUTH_TOKEN,TWILIO_MESSAGING_SERVICE_SID \
+               docker compose up -d --force-recreate --remove-orphans; \
              echo "✅ Staging stack refreshed with tag $IMG_TAG"'
 
     secrets: