chore: update secrets management in deployment scripts

kzndotsh · kzndotsh · commit 12ffe6c75bf5 · 2026-01-02T17:03:33.000-05:00
- Modify `secrets.sh` to clarify that `QUICKBOOKS_ADMIN_KEY` should be set directly in environment files.
- Update `deploy.yml` to reflect changes in secret management, marking `QUICKBOOKS_ADMIN_KEY` as environment-scoped.
- Enhance comments for clarity regarding the export of secrets and non-sensitive variables.

These changes improve the organization and clarity of environment variable management in the deployment process.
diff --git a/.github/scripts/secrets.sh b/.github/scripts/secrets.sh
@@ -30,6 +30,8 @@ elif [ -f .env.secrets.dev ]; then
   # shellcheck disable=SC1091
   source .env.secrets.dev 2>/dev/null
 fi
+
+# QUICKBOOKS_ADMIN_KEY should be set directly in the environment files
 export CLOUDFLARE_API_TOKEN
 
 # Verify wrangler authentication
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -65,16 +65,17 @@ jobs:
           .github/scripts/secrets.sh "$ENV_NAME"
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          # Export all secrets as environment variables for the script
+          # Export all secrets as environment variables for the script (now environment-scoped)
           QUICKBOOKS_CLIENT_ID: ${{ secrets.QUICKBOOKS_CLIENT_ID }}
           QUICKBOOKS_CLIENT_SECRET: ${{ secrets.QUICKBOOKS_CLIENT_SECRET }}
           QUICKBOOKS_REFRESH_TOKEN: ${{ secrets.QUICKBOOKS_REFRESH_TOKEN }}
           QUICKBOOKS_REALM_ID: ${{ secrets.QUICKBOOKS_REALM_ID }}
+          # Environment-specific admin key (now from environment secrets)
           QUICKBOOKS_ADMIN_KEY: ${{ secrets.QUICKBOOKS_ADMIN_KEY }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           MONDAY_API_KEY: ${{ secrets.MONDAY_API_KEY }}
           TRIGGER_SECRET_KEY: ${{ secrets.TRIGGER_SECRET_KEY }}
-          # Variables (non-sensitive)
+          # Variables (non-sensitive, now environment-scoped)
           MONDAY_BOARD_ID: ${{ vars.MONDAY_BOARD_ID }}
           DISCORD_WEBHOOK_URL: ${{ vars.DISCORD_WEBHOOK_URL }}
           QUICKBOOKS_ENVIRONMENT: ${{ vars.QUICKBOOKS_ENVIRONMENT }}
