strioe build fix

.gitea/workflows/build-and-deploy.yml

@@ -480,6 +480,7 @@ jobs:
             export STRIPE_API_KEY_B64='$STRIPE_API_KEY_B64'
             export STRIPE_WEBHOOK_SECRET_B64='$STRIPE_WEBHOOK_SECRET_B64'
             bash scripts/apply-env-secret-overrides.sh .env.docker.production STRIPE_API_KEY STRIPE_WEBHOOK_SECRET
+            bash scripts/describe-env-values.sh .env.docker.production STRIPE_API_KEY STRIPE_WEBHOOK_SECRET
             cp .env.docker.production '$DEPLOY_ROOT/.env.docker.production'
             chmod 600 '$DEPLOY_ROOT/.env.docker.production'
             export APP_IMAGE='$DEPLOY_REGISTRY_HOST/$IMAGE_REPOSITORY'

scripts/describe-env-values.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage:
+  describe-env-values.sh <env-file> <KEY> [KEY...]
+
+Prints a non-secret status for each requested key in <env-file>.
+EOF
+}
+
+if [[ $# -lt 2 ]]; then
+  usage >&2
+  exit 1
+fi
+
+env_file="$1"
+shift
+
+if [[ ! -f "${env_file}" ]]; then
+  echo "Missing env file: ${env_file}" >&2
+  exit 1
+fi
+
+read_env_value() {
+  local key="$1"
+  local value
+
+  value="$(
+    awk -F= -v key="${key}" '
+      /^[[:space:]]*#/ || index($0, "=") == 0 {
+        next
+      }
+      {
+        name = $1
+        sub(/^[[:space:]]*export[[:space:]]+/, "", name)
+        gsub(/^[[:space:]]+|[[:space:]]+$/, "", name)
+        if (name == key) {
+          value = substr($0, index($0, "=") + 1)
+        }
+      }
+      END {
+        print value
+      }
+    ' "${env_file}"
+  )"
+
+  value="${value%$'\r'}"
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+  if [[ "${value}" == \"*\" && "${value}" == *\" ]]; then
+    value="${value#\"}"
+    value="${value%\"}"
+  elif [[ "${value}" == \'*\' && "${value}" == *\' ]]; then
+    value="${value#\'}"
+    value="${value%\'}"
+  fi
+  printf '%s' "${value}"
+}
+
+describe_value() {
+  local key="$1"
+  local value="$2"
+
+  if [[ -z "${value}" ]]; then
+    printf '%s: missing\n' "${key}"
+  elif [[ "${value}" == placeholder || "${value}" == replace-with-* || "${value}" == *changeme* || "${value}" == *change-me* ]]; then
+    printf '%s: placeholder\n' "${key}"
+  elif [[ "${key}" == STRIPE_API_KEY && ( "${value}" == sk_live_* || "${value}" == rk_live_* ) ]]; then
+    printf '%s: valid live prefix\n' "${key}"
+  elif [[ "${key}" == STRIPE_WEBHOOK_SECRET && "${value}" == whsec_* ]]; then
+    printf '%s: valid webhook prefix\n' "${key}"
+  else
+    printf '%s: invalid prefix\n' "${key}"
+  fi
+}
+
+for key in "$@"; do
+  describe_value "${key}" "$(read_env_value "${key}")"
+done