Skip to content
GitLab

feat(infra): add a staging env edit-and-redeploy command

Merged Khanh Pham requested to merge feat/staging-edit-env into develop

Summary

infra/runtime/staging/edit-env.sh: one command to change the staging app env and redeploy it.

infra/runtime/staging/edit-env.sh                # open moanapay/staging/app-env in $EDITOR, save, confirm
infra/runtime/staging/edit-env.sh FILE           # replace the env with FILE
infra/runtime/staging/edit-env.sh --redeploy     # redeploy only
infra/runtime/staging/edit-env.sh --rollback-env # restore the previous env version and redeploy

Runs on the Mac (needs ssh moanapay-vps + authenticated glab).

  • Fetches the secret byte-exact into a 0700 temp dir, removed on exit; values never printed.
  • Validates: no NUL, only KEY=value/comment/blank lines, no duplicate keys.
  • Shows added / removed / changed / newly EMPTY key names, then asks y/N.
  • Refuses to push if the secret's VersionId changed while editing.
  • Redeploys by retrying the CI job behind the staging environment's last deployment (same job, lock and logs as a normal deploy), waits up to 20 min, then requires /health.
  • Any failure after the push prints the job URL and both recovery commands (--redeploy, --rollback-env). The CI trace is not printed.

Verification

  • shellcheck clean.
  • Live against staging LocalStack: no-change exit, diff + abort, invalid env rejected, rollback no-op, concurrent-change refusal, byte-exact fetch/push round trip (twice).
  • Stubbed: glab 502 after push, push failure, job success + failing /health → nonzero exit with recovery guidance.
  • Not exercised live: the job retry itself (it restarts staging).
  • Codex adversarial review: 3 rounds, did not formally converge. All findings fixed except one, rebutted: a backend-owned env schema is a separate be/ feature.

🤖 Generated with Claude Code