fixed secret handling in deployment workflow

Author: olsenben

.github/workflows/deploy.yml

@@ -47,27 +47,15 @@ jobs:
         id: env
         run: |
           if [ "${{ github.ref }}" == "refs/heads/main" ]; then
-            echo "SSH_HOST=${{ secrets.SSH_HOST }}" >> $GITHUB_ENV
-            echo "SSH_USER=${{ secrets.SSH_USER }}" >> $GITHUB_ENV
-            echo "SSH_PRIVATE_KEY=${{ secrets.SSH_PRIVATE_KEY }}" >> $GITHUB_ENV
-            echo "SITE_URL=${{ secrets.SITE_URL }}" >> $GITHUB_ENV
-            echo "BACKEND_URL=${{ secrets.BACKEND_URL }}" >> $GITHUB_ENV
             echo "DEPLOY_PATH=${{ secrets.DEPLOY_PATH || '~/processordb-website' }}" >> $GITHUB_ENV
             echo "PM2_APP_NAME=ProcessorDB-website" >> $GITHUB_ENV
             echo "PM2_PORT=3000" >> $GITHUB_ENV
             echo "ECOSYSTEM_FILE=ecosystem.config.js" >> $GITHUB_ENV
           else
             # For staging, use port from secret or default to 3001 (same instance) or 3000 (separate)
-            # If using same instance as production, use 3001. If separate instance, use 3000.
-            # You can override by setting PORT secret in staging environment
             DEPLOY_PATH="${{ secrets.DEPLOY_PATH || '~/processordb-website-staging' }}"
             STAGING_PORT="${{ secrets.PORT || '3001' }}"
             
-            echo "SSH_HOST=${{ secrets.SSH_HOST }}" >> $GITHUB_ENV
-            echo "SSH_USER=${{ secrets.SSH_USER }}" >> $GITHUB_ENV
-            echo "SSH_PRIVATE_KEY=${{ secrets.SSH_PRIVATE_KEY }}" >> $GITHUB_ENV
-            echo "SITE_URL=${{ secrets.SITE_URL }}" >> $GITHUB_ENV
-            echo "BACKEND_URL=${{ secrets.BACKEND_URL }}" >> $GITHUB_ENV
             echo "DEPLOY_PATH=$DEPLOY_PATH" >> $GITHUB_ENV
             echo "PM2_APP_NAME=ProcessorDB-website-staging" >> $GITHUB_ENV
             echo "PM2_PORT=$STAGING_PORT" >> $GITHUB_ENV
@@ -77,8 +65,8 @@ jobs:
       - name: Build application
         run: npm run build
         env:
-          SITE_URL: ${{ env.SITE_URL }}
-          BACKEND_URL: ${{ env.BACKEND_URL }}
+          SITE_URL: ${{ secrets.SITE_URL }}
+          BACKEND_URL: ${{ secrets.BACKEND_URL }}
 
       - name: Create staging ecosystem config
         if: github.ref != 'refs/heads/main'
@@ -107,12 +95,12 @@ jobs:
       - name: Setup SSH
         uses: webfactory/[email protected]
         with:
-          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
+          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
 
       - name: Add server to known hosts
         run: |
           mkdir -p ~/.ssh
-          ssh-keyscan -H ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
+          ssh-keyscan -H ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts
 
       - name: Deploy to ${{ env.ENVIRONMENT }}
         run: |
@@ -121,10 +109,10 @@ jobs:
           ECOSYSTEM_FILE="${{ env.ECOSYSTEM_FILE }}"
           
           # Copy files to server
-          scp -r deploy.tar.gz ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:$DEPLOY_PATH/
+          scp -r deploy.tar.gz ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:$DEPLOY_PATH/
           
           # SSH into server and deploy
-          ssh ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "bash -s" << EOF
+          ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} "bash -s" << EOF
             set -e
             cd $DEPLOY_PATH