From 5b2b01db21c981a32275a6b79e5427a0d5678ef2 Mon Sep 17 00:00:00 2001
From: adam jones <adamj@anthropic.com>
Date: Wed, 1 Oct 2025 01:08:42 +0100
Subject: [PATCH] Use intermediate env var for Pulumi passphrase (#4)

Addresses security concern where secrets were directly interpolated in
run commands. Following GitHub's security best practices, the secret is
now passed through an intermediate environment variable before being
written to the file.

This maintains compatibility with the existing Makefile workflow while
reducing the risk of accidental secret disclosure.
---
 .github/workflows/deploy.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index ff4b5b6..d0b7a64 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -49,6 +49,8 @@ jobs:
           credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }}
 
       - name: Deploy to Production
+        env:
+          PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
         run: |
-          echo "${{ secrets.PULUMI_PROD_PASSPHRASE }}" > passphrase.prod.txt
+          echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt
           make up
\ No newline at end of file