From 21e34295f1922d06a008fe8e8e687e3bac41d6bf Mon Sep 17 00:00:00 2001 From: Yonas Tewabe Date: Tue, 18 Aug 2026 10:57:57 +0300 Subject: [PATCH 1/6] Create sync-env-from-env-manager.sh --- scripts/deploy/sync-env-from-env-manager.sh | 80 +++++++++++++++++++++ 1 file changed, 80 insertions(+) create mode 100644 scripts/deploy/sync-env-from-env-manager.sh diff --git a/scripts/deploy/sync-env-from-env-manager.sh b/scripts/deploy/sync-env-from-env-manager.sh new file mode 100644 index 000000000..15d0f1e09 --- /dev/null +++ b/scripts/deploy/sync-env-from-env-manager.sh @@ -0,0 +1,80 @@ +#!/usr/bin/env bash +# Sync .env files from the Env Manager API into the repo. +# +# Usage: +# ENV_MANAGER_TOKEN=xxx ./scripts/deploy/sync-env-from-server.sh freight-api freight-portal freight-backoffice +# +# You normally only need to pass the token via the action secret, and BRANCH +# via the job-level env (e.g. `BRANCH: ${{ github.ref_name }}` in the workflow): +# env: +# BRANCH: ${{ github.ref_name }} +# ENV_MANAGER_TOKEN: ${{ secrets.ENV_MANAGER_TOKEN }} +# +# API layout (one endpoint per service): +# GET https://env.smart.aaca.gov.et/api/env/edr//?format=dotenv +# Header: Authorization: Bearer +set -euo pipefail + +PROJECT="edr" +ENV_MANAGER_URL="https://env.smart.aaca.gov.et" +BRANCH="${BRANCH:?BRANCH is required}" +ENV_MANAGER_TOKEN="${ENV_MANAGER_TOKEN:?ENV_MANAGER_TOKEN is required}" + +declare -A SERVICE_ENV_TARGET=( + ["ema_portal"]="apps/portal/.env" + ["ema_backoffice"]="apps/backoffice/.env" +) + +for service in "$@"; do + branch_api_name="${BRANCH//-/_}" + service_api_name="${service//-/_}" + dest="${SERVICE_ENV_TARGET[${service_api_name}]:-}" + if [[ -z "${dest}" ]]; then + echo "Unknown service: ${service}" >&2 + exit 1 + fi + + url="${ENV_MANAGER_URL}/api/env/${PROJECT}/${branch_api_name}/${service_api_name}?format=dotenv" + mkdir -p "$(dirname "${dest}")" + + tmp_file="$(mktemp)" + trap 'rm -f "${tmp_file}"' RETURN 2>/dev/null || true + + http_status=$(curl -fsS -o "${tmp_file}" -w "%{http_code}" \ + -H "Authorization: Bearer ${ENV_MANAGER_TOKEN}" \ + "${url}") || { + echo "Failed to fetch env for '${service}' from ${url}" >&2 + rm -f "${tmp_file}" + exit 1 + } + + if [[ "${http_status}" != "200" ]]; then + echo "Env Manager returned HTTP ${http_status} for '${service}' (${url})" >&2 + rm -f "${tmp_file}" + exit 1 + fi + + if [[ ! -s "${tmp_file}" ]]; then + echo "Env Manager returned an empty response for '${service}' (${url})" >&2 + rm -f "${tmp_file}" + exit 1 + fi + + mv "${tmp_file}" "${dest}" + echo "Synced ${url} -> ${dest}" + + port_value=$(sed -n -E 's/^[[:space:]]*PORT[[:space:]]*=[[:space:]]*"?([^"#]+)"?[[:space:]]*(#.*)?$/\1/p' "${dest}" | head -n1 | tr -d '[:space:]') + if [[ -z "${port_value}" ]]; then + echo "Missing required PORT in env file for '${service}' (${dest})" >&2 + exit 1 + fi + + if [[ -n "${GITHUB_ENV:-}" ]]; then + service_var=$(echo "${service}" | tr '[:lower:]-' '[:upper:]_') + echo "${service_var}_PORT=${port_value}" >> "${GITHUB_ENV}" + echo "Exported ${service_var}_PORT from ${dest}" + # Forward NEXT_PUBLIC_* and VITE_* vars so docker compose build can inject them as build args. + grep -E '^[[:space:]]*(NEXT_PUBLIC_|VITE_)[A-Za-z0-9_]+=' "${dest}" \ + | sed -E 's/^[[:space:]]*//' >> "${GITHUB_ENV}" || true + fi +done From 94abc333922040472ac35a421dcee14bf78e5011 Mon Sep 17 00:00:00 2001 From: Yonas Tewabe Date: Tue, 18 Aug 2026 11:01:40 +0300 Subject: [PATCH 2/6] Update deploy.yml --- .github/workflows/deploy.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 5615e88a7..34a438f34 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -33,6 +33,7 @@ jobs: BUILD_ENV_FILE: ${{ matrix.build_env_file }} DOCKER_BUILDKIT: "1" COMPOSE_DOCKER_CLI_BUILD: "1" + ENV_MANAGER_TOKEN: ${{ secrets.ENV_MANAGER_TOKEN }} steps: - name: Checkout uses: actions/checkout@v4 @@ -40,7 +41,7 @@ jobs: - name: Sync environment from server run: | chmod +x scripts/deploy/*.sh - ./scripts/deploy/sync-env-from-server.sh "${{ matrix.service }}" + ./scripts/deploy/sync-env-from-env-manager.sh "${{ matrix.service }}" - name: Set compose project name run: | From d58037913083ad7bb37e18f98fa78043b97db44f Mon Sep 17 00:00:00 2001 From: Yonas Tewabe Date: Tue, 18 Aug 2026 11:03:20 +0300 Subject: [PATCH 3/6] Change project name from 'edr' to 'ema' --- scripts/deploy/sync-env-from-env-manager.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/deploy/sync-env-from-env-manager.sh b/scripts/deploy/sync-env-from-env-manager.sh index 15d0f1e09..4a657df1c 100644 --- a/scripts/deploy/sync-env-from-env-manager.sh +++ b/scripts/deploy/sync-env-from-env-manager.sh @@ -15,7 +15,7 @@ # Header: Authorization: Bearer set -euo pipefail -PROJECT="edr" +PROJECT="ema" ENV_MANAGER_URL="https://env.smart.aaca.gov.et" BRANCH="${BRANCH:?BRANCH is required}" ENV_MANAGER_TOKEN="${ENV_MANAGER_TOKEN:?ENV_MANAGER_TOKEN is required}" From a513c5d0b9dbf6474d57e10a5161db2a61e69426 Mon Sep 17 00:00:00 2001 From: Yonas Tewabe Date: Tue, 18 Aug 2026 11:08:34 +0300 Subject: [PATCH 4/6] Update deploy.yml --- .github/workflows/deploy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 34a438f34..5b1dd8d47 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -38,7 +38,7 @@ jobs: - name: Checkout uses: actions/checkout@v4 - - name: Sync environment from server + - name: Sync environment from Env Manager App run: | chmod +x scripts/deploy/*.sh ./scripts/deploy/sync-env-from-env-manager.sh "${{ matrix.service }}" From 0c05876b2ea315d004b9ae2ab2ed0b2e74963b69 Mon Sep 17 00:00:00 2001 From: Sennay Date: Fri, 21 Aug 2026 10:57:17 +0300 Subject: [PATCH 5/6] Delete pnpm-workspace.yaml --- pnpm-workspace.yaml | 5 ----- 1 file changed, 5 deletions(-) delete mode 100644 pnpm-workspace.yaml diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml deleted file mode 100644 index ace04a986..000000000 --- a/pnpm-workspace.yaml +++ /dev/null @@ -1,5 +0,0 @@ -allowBuilds: - canvas: set this to true or false - core-js: set this to true or false - esbuild: set this to true or false - nx: set this to true or false From b227e0ec89cc87447545c33322eed619bd4a5c3c Mon Sep 17 00:00:00 2001 From: Sennay Date: Fri, 21 Aug 2026 10:59:19 +0300 Subject: [PATCH 6/6] Create pnpm-workspace.yaml --- pnpm-workspace.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 pnpm-workspace.yaml diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml new file mode 100644 index 000000000..6b31eb215 --- /dev/null +++ b/pnpm-workspace.yaml @@ -0,0 +1,9 @@ +packages: + 'apps/*' + 'libs/*' + 'local-packages/*' +allowBuilds: + canvas: set this to true or false + core-js: set this to true or false + esbuild: set this to true or false + nx: set this to true or false