From af3674f8d6d293a23b2d937ceda8f306b727c07d Mon Sep 17 00:00:00 2001 From: Clemence Kyara Date: Tue, 22 Sep 2026 16:54:02 +0300 Subject: [PATCH 1/2] fix(charterafrica): align Payload build secrets --- .github/workflows/_build-charterafrica.yml | 4 ++-- .github/workflows/charterafrica-deploy-dev.yml | 4 ++-- .github/workflows/charterafrica-deploy-prod.yml | 4 ++-- .github/workflows/charterafrica.yml | 4 ++-- .github/workflows/pr-build.yml | 2 +- Dockerfile | 4 ++-- apps/charterafrica/.env.template | 2 +- apps/charterafrica/server.ts | 2 +- apps/charterafrica/turbo.json | 4 ++-- docker-bake.hcl | 11 ++++------- docker/apps/charterafrica/Dockerfile | 2 +- 11 files changed, 20 insertions(+), 23 deletions(-) diff --git a/.github/workflows/_build-charterafrica.yml b/.github/workflows/_build-charterafrica.yml index 74c99d92ab..0d254882ff 100644 --- a/.github/workflows/_build-charterafrica.yml +++ b/.github/workflows/_build-charterafrica.yml @@ -40,7 +40,7 @@ on: required: false DATABASE_URL: required: false - PAYLOAD_SECRET_KEY: + PAYLOAD_SECRET: required: false NEXT_PUBLIC_SENTRY_DSN: required: false @@ -72,7 +72,7 @@ jobs: DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }} DOCKER_HUB_ACCESS_TOKEN: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }} DATABASE_URL: ${{ secrets.DATABASE_URL }} - PAYLOAD_SECRET_KEY: ${{ secrets.PAYLOAD_SECRET_KEY }} + PAYLOAD_SECRET: ${{ secrets.PAYLOAD_SECRET }} NEXT_PUBLIC_SENTRY_DSN: ${{ secrets.NEXT_PUBLIC_SENTRY_DSN }} SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} SENTRY_ORG: ${{ secrets.SENTRY_ORG }} diff --git a/.github/workflows/charterafrica-deploy-dev.yml b/.github/workflows/charterafrica-deploy-dev.yml index e5c20d0713..11fc599571 100644 --- a/.github/workflows/charterafrica-deploy-dev.yml +++ b/.github/workflows/charterafrica-deploy-dev.yml @@ -66,8 +66,8 @@ jobs: platforms: linux/arm64 push: true secrets: | - "mongo_url=${{ secrets.CHARTERAFRICA_MONGO_URL }}" - "payload_secret_key=${{ secrets.CHARTERAFRICA_PAYLOAD_SECRET_KEY }}" + "database_url=${{ secrets.CHARTERAFRICA_MONGO_URL }}" + "payload_secret=${{ secrets.CHARTERAFRICA_PAYLOAD_SECRET_KEY }}" "sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}" "sentry_org=${{ secrets.SENTRY_ORG }}" "sentry_project=${{ secrets.CHARTERAFRICA_SENTRY_PROJECT }}" diff --git a/.github/workflows/charterafrica-deploy-prod.yml b/.github/workflows/charterafrica-deploy-prod.yml index 9a287692ea..f2477d59a8 100644 --- a/.github/workflows/charterafrica-deploy-prod.yml +++ b/.github/workflows/charterafrica-deploy-prod.yml @@ -91,8 +91,8 @@ jobs: platforms: linux/amd64 push: true secrets: | - "mongo_url=${{ secrets.CHARTERAFRICA_MONGO_URL }}" - "payload_secret_key=${{ secrets.CHARTERAFRICA_PAYLOAD_SECRET_KEY }}" + "database_url=${{ secrets.CHARTERAFRICA_MONGO_URL }}" + "payload_secret=${{ secrets.CHARTERAFRICA_PAYLOAD_SECRET_KEY }}" "sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}" "sentry_org=${{ secrets.SENTRY_ORG }}" "sentry_project=${{ secrets.CHARTERAFRICA_SENTRY_PROJECT }}" diff --git a/.github/workflows/charterafrica.yml b/.github/workflows/charterafrica.yml index 19ecf5e27b..70dc620e95 100644 --- a/.github/workflows/charterafrica.yml +++ b/.github/workflows/charterafrica.yml @@ -72,7 +72,7 @@ jobs: DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }} DOCKER_HUB_ACCESS_TOKEN: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }} DATABASE_URL: ${{ secrets.CHARTERAFRICA_MONGO_URL }} - PAYLOAD_SECRET_KEY: ${{ secrets.CHARTERAFRICA_PAYLOAD_SECRET_KEY }} + PAYLOAD_SECRET: ${{ secrets.CHARTERAFRICA_PAYLOAD_SECRET_KEY }} NEXT_PUBLIC_SENTRY_DSN: ${{ secrets.CHARTERAFRICA_SENTRY_DSN }} SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} SENTRY_ORG: ${{ secrets.SENTRY_ORG }} @@ -114,7 +114,7 @@ jobs: DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }} DOCKER_HUB_ACCESS_TOKEN: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }} DATABASE_URL: ${{ secrets.CHARTERAFRICA_MONGO_URL }} - PAYLOAD_SECRET_KEY: ${{ secrets.CHARTERAFRICA_PAYLOAD_SECRET_KEY }} + PAYLOAD_SECRET: ${{ secrets.CHARTERAFRICA_PAYLOAD_SECRET_KEY }} NEXT_PUBLIC_SENTRY_DSN: ${{ secrets.CHARTERAFRICA_SENTRY_DSN }} SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} SENTRY_ORG: ${{ secrets.SENTRY_ORG }} diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml index 17a2e7ced3..66745a3c07 100644 --- a/.github/workflows/pr-build.yml +++ b/.github/workflows/pr-build.yml @@ -131,7 +131,7 @@ jobs: # apps — PR builds need a genuinely reachable database, not a dummy # value. DATABASE_URL: ${{ secrets.CHARTERAFRICA_MONGO_URL }} - PAYLOAD_SECRET_KEY: pr-build-unused + PAYLOAD_SECRET: pr-build-unused NEXT_PUBLIC_SENTRY_DSN: pr-build-unused SENTRY_AUTH_TOKEN: pr-build-unused SENTRY_ORG: pr-build-unused diff --git a/Dockerfile b/Dockerfile index 03856891f1..0d9f46ee52 100644 --- a/Dockerfile +++ b/Dockerfile @@ -204,8 +204,8 @@ COPY apps/charterafrica ./apps/charterafrica/ # When building Next.js app, Next.js needs to connect to local Payload ENV PAYLOAD_PUBLIC_APP_URL=http://localhost:3000 ENV NEXT_PUBLIC_SEO_DISABLED=${NEXT_PUBLIC_SEO_DISABLED} -RUN --mount=type=secret,id=mongo_url,env=MONGO_URL \ - --mount=type=secret,id=payload_secret_key,env=PAYLOAD_SECRET_KEY \ +RUN --mount=type=secret,id=database_url,env=DATABASE_URL \ + --mount=type=secret,id=payload_secret,env=PAYLOAD_SECRET \ --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \ --mount=type=secret,id=sentry_org,env=SENTRY_ORG \ --mount=type=secret,id=sentry_project,env=SENTRY_PROJECT \ diff --git a/apps/charterafrica/.env.template b/apps/charterafrica/.env.template index 11a27cb9aa..45729a21fd 100644 --- a/apps/charterafrica/.env.template +++ b/apps/charterafrica/.env.template @@ -5,7 +5,7 @@ DATABASE_URL PAYLOAD_CORS PAYLOAD_CSRF PAYLOAD_PUBLIC_APP_URL -PAYLOAD_SECRET_KEY +PAYLOAD_SECRET S3_ACCESS_KEY_ID= diff --git a/apps/charterafrica/server.ts b/apps/charterafrica/server.ts index cf70c8c6a9..6d24da4627 100644 --- a/apps/charterafrica/server.ts +++ b/apps/charterafrica/server.ts @@ -60,7 +60,7 @@ const start = async (): Promise => { }, } : undefined), - secret: process.env.PAYLOAD_SECRET_KEY, + secret: process.env.PAYLOAD_SECRET, express: server, onInit: (initPayload) => { initPayload.logger.info( diff --git a/apps/charterafrica/turbo.json b/apps/charterafrica/turbo.json index ff28aee9d2..b26b5313fc 100644 --- a/apps/charterafrica/turbo.json +++ b/apps/charterafrica/turbo.json @@ -21,7 +21,7 @@ "PAYLOAD_PUBLIC_APP_URL", "PAYLOAD_PUBLIC_DEFAULT_LOCALE", "PAYLOAD_PUBLIC_LOCALES", - "PAYLOAD_SECRET_KEY", + "PAYLOAD_SECRET", "PROJECT_ROOT", "RESOURCES_SECRET_TOKEN", "S3_ACCESS_KEY_ID", @@ -53,7 +53,7 @@ "PAYLOAD_PUBLIC_APP_URL", "PAYLOAD_PUBLIC_DEFAULT_LOCALE", "PAYLOAD_PUBLIC_LOCALES", - "PAYLOAD_SECRET_KEY", + "PAYLOAD_SECRET", "PORT", "PUBLIC_CHARTERAFRICA_SENTRY_DSN", "RESOURCES_SECRET_TOKEN", diff --git a/docker-bake.hcl b/docker-bake.hcl index f33ff5fa75..eb726f8b05 100644 --- a/docker-bake.hcl +++ b/docker-bake.hcl @@ -198,20 +198,17 @@ target "_payload-app-runner" { } target "charterafrica" { - inherits = ["_app-runner"] + inherits = ["_payload-app-runner"] dockerfile = "docker/apps/charterafrica/Dockerfile" tags = ["${REGISTRY}charterafrica:${TAG}"] args = { NEXT_PUBLIC_APP_URL = "${NEXT_PUBLIC_APP_URL}" SENTRY_ENVIRONMENT = "${SENTRY_ENVIRONMENT}" } - # sentry_auth_token/org/project are inherited from _app. database_url, - # payload_secret_key, and next_public_sentry_dsn are charterafrica-specific - # — it reads PAYLOAD_SECRET_KEY (not PAYLOAD_SECRET like _payload-app-runner - # provides), so this declares its own secret list rather than inheriting it. + # sentry_auth_token/org/project are inherited from _app. + # database_url and payload_secret are inherited from _payload-app-runner. + # next_public_sentry_dsn is charterafrica-specific secret = [ - "type=env,id=database_url,env=DATABASE_URL", - "type=env,id=payload_secret_key,env=PAYLOAD_SECRET_KEY", "type=env,id=next_public_sentry_dsn,env=NEXT_PUBLIC_SENTRY_DSN", ] } diff --git a/docker/apps/charterafrica/Dockerfile b/docker/apps/charterafrica/Dockerfile index 000ed095dd..2e7f8b5fff 100644 --- a/docker/apps/charterafrica/Dockerfile +++ b/docker/apps/charterafrica/Dockerfile @@ -43,7 +43,7 @@ ENV PAYLOAD_PUBLIC_APP_URL=http://localhost:3000 # it stays unlogged without needing a GitHub Variable migration — it's # stored as a GitHub Secret today even though DSNs aren't actually sensitive. RUN --mount=type=secret,id=database_url,env=DATABASE_URL \ - --mount=type=secret,id=payload_secret_key,env=PAYLOAD_SECRET_KEY \ + --mount=type=secret,id=payload_secret,env=PAYLOAD_SECRET \ --mount=type=secret,id=next_public_sentry_dsn,env=NEXT_PUBLIC_SENTRY_DSN \ --mount=type=secret,id=sentry_auth_token,env=SENTRY_AUTH_TOKEN \ --mount=type=secret,id=sentry_org,env=SENTRY_ORG \ From a4539b05b4d1af185f0d3393d7142a058c75d2a2 Mon Sep 17 00:00:00 2001 From: Clemence Kyara Date: Tue, 22 Sep 2026 16:54:40 +0300 Subject: [PATCH 2/2] docs(charterafrica): fix env setup command --- apps/charterafrica/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/charterafrica/README.md b/apps/charterafrica/README.md index 7afec94b67..71d3510ff9 100644 --- a/apps/charterafrica/README.md +++ b/apps/charterafrica/README.md @@ -7,7 +7,7 @@ This is the official code for https://charter.africa site First create `.env.local` file in the root directory of the project. ```bash -cp env.template .env.local +cp .env.template .env.local ``` and modify the `.env.local` file according to your needs.