chore(ci): pass channel-specific env vars to vercel deploy (#2834)

* chore(ci): pass channel-specific env vars to vercel deploy

* chore(ci): harden deploy workflow security

replace eval with bash arrays, add timeouts, improve secret handling

* chore(ci): add b2b env vars to deploy workflow

Author: matthewvolk

.github/workflows/deploy.yml

@@ -11,7 +11,7 @@ on:
             - "@bigcommerce/catalyst-b2b-makeswift@latest"
 jobs:
     deploy-tag:
-        name: Deploy `{{ github.ref_name }}` tag
+        name: Deploy `${{ github.ref_name }}` tag
         runs-on: ubuntu-latest
         concurrency:
             group: ${{ github.workflow }}-${{ github.ref_name }}
@@ -21,25 +21,61 @@ jobs:
             - name: Install Vercel CLI
               run: npm install --global vercel@latest
 
-            - name: Parse Tag and Build Domain
-              id: parse-tag
+            - name: Configure catalyst-core deployment
+              if: contains(github.ref_name, 'catalyst-core@')
               run: |
-                  TAG="${{ github.ref_name }}"
-                  PACKAGE_NAME=$(echo "$TAG" | sed -E 's/^@bigcommerce\/([^@]+)@.*$/\1/')
-                  case "$PACKAGE_NAME" in
-                    "catalyst-core") DOMAIN="catalyst-demo.site" ;;
-                    "catalyst-makeswift") DOMAIN="makeswift.catalyst-demo.site" ;;
-                    "catalyst-b2b-makeswift") DOMAIN="b2b-makeswift.catalyst-demo.site" ;;
-                    *) echo "Error: Unknown package name: $PACKAGE_NAME"; exit 1 ;;
-                  esac
-                  echo "domain=$DOMAIN" >> $GITHUB_OUTPUT
+                  echo "DOMAIN=catalyst-demo.site" >> $GITHUB_ENV
+                  echo "CHANNEL_ID=${{ vars.CORE_BIGCOMMERCE_CHANNEL_ID }}" >> $GITHUB_ENV
+                  echo "STOREFRONT_TOKEN=${{ secrets.CORE_BIGCOMMERCE_STOREFRONT_TOKEN }}" >> $GITHUB_ENV
+
+            - name: Configure catalyst-makeswift deployment
+              if: contains(github.ref_name, 'catalyst-makeswift@')
+              run: |
+                  echo "DOMAIN=makeswift.catalyst-demo.site" >> $GITHUB_ENV
+                  echo "CHANNEL_ID=${{ vars.MAKESWIFT_BIGCOMMERCE_CHANNEL_ID }}" >> $GITHUB_ENV
+                  echo "STOREFRONT_TOKEN=${{ secrets.MAKESWIFT_BIGCOMMERCE_STOREFRONT_TOKEN }}" >> $GITHUB_ENV
+                  echo "MAKESWIFT_KEY=${{ secrets.MAKESWIFT_SITE_API_KEY }}" >> $GITHUB_ENV
+
+            - name: Configure catalyst-b2b-makeswift deployment
+              if: contains(github.ref_name, 'catalyst-b2b-makeswift@')
+              run: |
+                  echo "DOMAIN=b2b-makeswift.catalyst-demo.site" >> $GITHUB_ENV
+                  echo "CHANNEL_ID=${{ vars.B2B_MAKESWIFT_BIGCOMMERCE_CHANNEL_ID }}" >> $GITHUB_ENV
+                  echo "STOREFRONT_TOKEN=${{ secrets.B2B_MAKESWIFT_BIGCOMMERCE_STOREFRONT_TOKEN }}" >> $GITHUB_ENV
+                  echo "MAKESWIFT_KEY=${{ secrets.B2B_MAKESWIFT_SITE_API_KEY }}" >> $GITHUB_ENV
+                  echo "B2B_API_HOST=${{ vars.B2B_API_HOST }}" >> $GITHUB_ENV
+                  echo "BIGCOMMERCE_ACCESS_TOKEN=${{ secrets.B2B_BIGCOMMERCE_ACCESS_TOKEN }}" >> $GITHUB_ENV
 
             - name: Deploy to Vercel
               id: deploy
+              timeout-minutes: 15
+              env:
+                  VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
               run: |
-                  DEPLOYMENT_URL=$(vercel deploy --token=${{ secrets.VERCEL_TOKEN }})
+                  DEPLOY_ARGS=(
+                    --token="$VERCEL_TOKEN"
+                    --env BIGCOMMERCE_CHANNEL_ID="$CHANNEL_ID"
+                    --env BIGCOMMERCE_STOREFRONT_TOKEN="$STOREFRONT_TOKEN"
+                  )
+
+                  if [[ -n "$MAKESWIFT_KEY" ]]; then
+                    DEPLOY_ARGS+=(--env MAKESWIFT_SITE_API_KEY="$MAKESWIFT_KEY")
+                  fi
+
+                  if [[ -n "$B2B_API_HOST" ]]; then
+                    DEPLOY_ARGS+=(--env B2B_API_HOST="$B2B_API_HOST")
+                  fi
+
+                  if [[ -n "$BIGCOMMERCE_ACCESS_TOKEN" ]]; then
+                    DEPLOY_ARGS+=(--env BIGCOMMERCE_ACCESS_TOKEN="$BIGCOMMERCE_ACCESS_TOKEN")
+                  fi
+
+                  DEPLOYMENT_URL=$(vercel deploy "${DEPLOY_ARGS[@]}")
                   echo "deployment_url=$DEPLOYMENT_URL" >> $GITHUB_OUTPUT
 
             - name: Set Vercel Domain Alias
+              timeout-minutes: 5
+              env:
+                  VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
               run: |
-                  vercel alias ${{ steps.deploy.outputs.deployment_url }} ${{ steps.parse-tag.outputs.domain }} --token=${{ secrets.VERCEL_TOKEN }}
+                  vercel alias ${{ steps.deploy.outputs.deployment_url }} $DOMAIN --token="$VERCEL_TOKEN"