From fcb38f4a86ba55fee65c6a5f8a6254ebd719177b Mon Sep 17 00:00:00 2001
From: kelle <kellenberger.damian@gmail.com>
Date: Wed, 8 Jul 2026 19:40:03 +0200
Subject: [PATCH] Fix deploy workflow: inject secrets via Gitea Actions (job
 workspace is not bind-mounted to host)

---
 .gitea/workflows/deploy.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 6ac30db..f7f949b 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -10,11 +10,18 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@v4
       - name: Deploy to Server
+        env:
+          SESSION_SECRET: ${{ secrets.SESSION_SECRET }}
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
         run: |
           APP_DIR="/opt/aicds/apps/${GITHUB_REPOSITORY#*/}"
           mkdir -p $APP_DIR
           cp -a . $APP_DIR/
           cd $APP_DIR
+          cat > .env <<EOF
+          SESSION_SECRET=${SESSION_SECRET}
+          POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+          EOF
           docker compose down || true
           docker compose up -d --build
           docker image prune -f