From 888c24ed17bedaff14258953f6b44cbabb88dba1 Mon Sep 17 00:00:00 2001 From: QueryPlanner Date: Thu, 20 Aug 2026 17:54:48 +0530 Subject: [PATCH] fix: forward Telegram access code - Forward TELEGRAM_ACCESS_CODE to the production deployment - Serialize the access code in the remote Compose environment - Add a contract test for workflow secret propagation --- .github/workflows/docker-publish.yml | 2 ++ tests/test_deployment_contract.py | 19 +++++++++++++++++++ 2 files changed, 21 insertions(+) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index e22df94..0a0e9ff 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -107,6 +107,7 @@ jobs: OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} ROOT_AGENT_MODEL: ${{ secrets.ROOT_AGENT_MODEL }} TELEGRAM_ENABLED: ${{ secrets.TELEGRAM_ENABLED }} + TELEGRAM_ACCESS_CODE: ${{ secrets.TELEGRAM_ACCESS_CODE }} TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }} TELEGRAM_TOOL_NOTIFICATIONS: ${{ secrets.TELEGRAM_TOOL_NOTIFICATIONS }} KOKORO_TTS_BASE_URL: ${{ secrets.KOKORO_TTS_BASE_URL }} @@ -185,6 +186,7 @@ jobs: OPENROUTER_API_KEY \ ROOT_AGENT_MODEL \ TELEGRAM_ENABLED \ + TELEGRAM_ACCESS_CODE \ TELEGRAM_BOT_TOKEN \ TELEGRAM_TOOL_NOTIFICATIONS \ KOKORO_TTS_BASE_URL \ diff --git a/tests/test_deployment_contract.py b/tests/test_deployment_contract.py index 71f3fcb..8f7c892 100644 --- a/tests/test_deployment_contract.py +++ b/tests/test_deployment_contract.py @@ -518,6 +518,25 @@ def test_production_deployment_serializes_host_bind_secret() -> None: assert 'HOST_BIND_IP="$DEPLOY_HOST_BIND_IP"' in deploy_script +def test_production_deployment_serializes_telegram_access_code() -> None: + """The Telegram access-control secret must reach the remote Compose environment.""" + workflow = _load_yaml(".github/workflows/docker-publish.yml") + deploy_step = next( + step + for step in workflow["jobs"]["deploy"]["steps"] + if step["name"] == "Deploy to Server via Tailscale" + ) + deploy_script = deploy_step["run"] + writer_start = deploy_script.index("python3 scripts/write_compose_env.py") + writer_end = deploy_script.index("printf '%s' \"$GH_TOKEN\"") + writer_names = deploy_script[writer_start:writer_end].split() + + assert deploy_step["env"]["TELEGRAM_ACCESS_CODE"] == ( + "${{ secrets.TELEGRAM_ACCESS_CODE }}" + ) + assert "TELEGRAM_ACCESS_CODE" in writer_names + + def test_production_deployment_shell_is_valid_bash() -> None: """Nested staging and preflight heredocs must remain valid shell syntax.""" assert BASH_EXECUTABLE is not None