ci(zapier): inject .zapierapprc from repo Variables instead of committing it

Keep the app id/key out of the public repo. CI writes .zapierapprc in the
deploy job from the ZAPIER_APP_ID / ZAPIER_APP_KEY repo Variables (non-secret
identifiers). Re-ignore the file; devs run `zapier-platform link` locally.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: caoxing9

.github/workflows/zapier.yml

@@ -65,6 +65,14 @@ jobs:
           cache: npm
           cache-dependency-path: packages/zapier/package-lock.json
       - run: npm ci
+      - name: Link app — write .zapierapprc from repo Variables
+        run: |
+          if [ -z "${{ vars.ZAPIER_APP_ID }}" ] || [ -z "${{ vars.ZAPIER_APP_KEY }}" ]; then
+            echo "::error::Set repo Variables ZAPIER_APP_ID and ZAPIER_APP_KEY (Settings -> Secrets and variables -> Actions -> Variables)."
+            exit 1
+          fi
+          printf '{"id": %s, "key": "%s"}\n' \
+            "${{ vars.ZAPIER_APP_ID }}" "${{ vars.ZAPIER_APP_KEY }}" > .zapierapprc
       - name: Guard — never overwrite a version that has users
         env:
           ZAPIER_DEPLOY_KEY: ${{ secrets.ZAPIER_DEPLOY_KEY }}

.gitignore

@@ -9,9 +9,10 @@ node_modules/
 .env.*
 !.env.example
 
-# NOTE: .zapierapprc holds the app id/key (identifiers, NOT a secret) and is
-# committed so CI can `zapier push`. The deploy key lives in ~/.zapierrc / the
-# ZAPIER_DEPLOY_KEY CI secret — never in the repo.
+# Zapier app linkage — kept out of the repo. CI writes it from the
+# ZAPIER_APP_ID / ZAPIER_APP_KEY repo Variables; locally run `zapier-platform
+# link`. (The deploy key lives in ~/.zapierrc / the ZAPIER_DEPLOY_KEY secret.)
+.zapierapprc
 
 # Build output
 build/

packages/zapier/.gitignore

@@ -1,5 +1,6 @@
 node_modules/
 .env
+.zapierapprc
 dist/
 build/
 *.zip