ci: harden deploy.yml against silent-empty + YAML-mangled secrets

.github/workflows/deploy.yml

@@ -7,44 +7,59 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    env:
+      COUNCIL_PLATFORM_URL: "${{ secrets.COUNCIL_PLATFORM_URL }}"
+      STELLAR_NETWORK: "${{ secrets.STELLAR_NETWORK }}"
+      RPC_URL: "${{ secrets.RPC_URL }}"
     steps:
       - uses: actions/checkout@v4
 
       - uses: denoland/setup-deno@v2
         with:
           deno-version: v2.x
 
+      - name: Validate testnet config inputs
+        run: |
+          set -euo pipefail
+          for var in COUNCIL_PLATFORM_URL STELLAR_NETWORK RPC_URL; do
+            if [ -z "${!var}" ]; then
+              echo "::error::Required env var $var is empty"
+              exit 1
+            fi
+          done
+          case "$STELLAR_NETWORK" in
+            testnet|mainnet) ;;
+            *) echo "::error::STELLAR_NETWORK must be 'testnet' or 'mainnet' (got: $STELLAR_NETWORK)"; exit 1 ;;
+          esac
+          for var in COUNCIL_PLATFORM_URL RPC_URL; do
+            val="${!var}"
+            case "$val" in
+              https://*) ;;
+              *) echo "::error::$var must start with https:// (got: $val)"; exit 1 ;;
+            esac
+          done
+
       - name: Generate production config
-        env:
-          COUNCIL_PLATFORM_URL: ${{ secrets.COUNCIL_PLATFORM_URL }}
-          STELLAR_NETWORK: ${{ secrets.STELLAR_NETWORK }}
-          RPC_URL: ${{ secrets.RPC_URL }}
         run: |
           deno eval "
-            const url = Deno.env.get('COUNCIL_PLATFORM_URL') || '';
-            if (!url) { console.error('COUNCIL_PLATFORM_URL secret is empty'); Deno.exit(1); }
-            const stellarNetwork = Deno.env.get('STELLAR_NETWORK') || '';
-            if (!stellarNetwork) { console.error('STELLAR_NETWORK secret is empty'); Deno.exit(1); }
-            const rpcUrl = Deno.env.get('RPC_URL') || '';
-            if (!rpcUrl) { console.error('RPC_URL secret is empty'); Deno.exit(1); }
             const config = {
               environment: 'production',
-              stellarNetwork,
-              rpcUrl,
-              councilPlatformUrl: url,
+              stellarNetwork: Deno.env.get('STELLAR_NETWORK'),
+              rpcUrl: Deno.env.get('RPC_URL'),
+              councilPlatformUrl: Deno.env.get('COUNCIL_PLATFORM_URL'),
             };
             Deno.writeTextFileSync('public/config.js',
               'window.__DASHBOARD_CONFIG__ = ' + JSON.stringify(config, null, 2) + ';\n');
-            console.log('Generated config.js pointing at', url);
+            console.log('Generated config.js');
           "
 
       - name: Build production bundle
         run: deno task build -- --production
 
       - name: Deploy to Tigris (testnet)
         env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.TIGRIS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.TIGRIS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: "${{ secrets.TIGRIS_ACCESS_KEY_ID }}"
+          AWS_SECRET_ACCESS_KEY: "${{ secrets.TIGRIS_SECRET_ACCESS_KEY }}"
           AWS_REGION: auto
         run: |
           aws s3 sync public/ s3://network-dashboard/ \
@@ -56,44 +71,59 @@ jobs:
   deploy-mainnet:
     runs-on: ubuntu-latest
     environment: mainnet
+    env:
+      COUNCIL_PLATFORM_URL: "${{ secrets.MAINNET_COUNCIL_PLATFORM_URL }}"
+      STELLAR_NETWORK: "${{ secrets.MAINNET_STELLAR_NETWORK }}"
+      RPC_URL: "${{ secrets.MAINNET_RPC_URL }}"
     steps:
       - uses: actions/checkout@v4
 
       - uses: denoland/setup-deno@v2
         with:
           deno-version: v2.x
 
+      - name: Validate mainnet config inputs
+        run: |
+          set -euo pipefail
+          for var in COUNCIL_PLATFORM_URL STELLAR_NETWORK RPC_URL; do
+            if [ -z "${!var}" ]; then
+              echo "::error::Required env var $var is empty"
+              exit 1
+            fi
+          done
+          case "$STELLAR_NETWORK" in
+            testnet|mainnet) ;;
+            *) echo "::error::STELLAR_NETWORK must be 'testnet' or 'mainnet' (got: $STELLAR_NETWORK)"; exit 1 ;;
+          esac
+          for var in COUNCIL_PLATFORM_URL RPC_URL; do
+            val="${!var}"
+            case "$val" in
+              https://*) ;;
+              *) echo "::error::$var must start with https:// (got: $val)"; exit 1 ;;
+            esac
+          done
+
       - name: Generate mainnet config
-        env:
-          COUNCIL_PLATFORM_URL: ${{ secrets.MAINNET_COUNCIL_PLATFORM_URL }}
-          STELLAR_NETWORK: ${{ secrets.MAINNET_STELLAR_NETWORK }}
-          RPC_URL: ${{ secrets.MAINNET_RPC_URL }}
         run: |
           deno eval "
-            const url = Deno.env.get('COUNCIL_PLATFORM_URL') || '';
-            if (!url) { console.error('MAINNET_COUNCIL_PLATFORM_URL secret is empty'); Deno.exit(1); }
-            const stellarNetwork = Deno.env.get('STELLAR_NETWORK') || '';
-            if (!stellarNetwork) { console.error('MAINNET_STELLAR_NETWORK secret is empty'); Deno.exit(1); }
-            const rpcUrl = Deno.env.get('RPC_URL') || '';
-            if (!rpcUrl) { console.error('MAINNET_RPC_URL secret is empty'); Deno.exit(1); }
             const config = {
               environment: 'production',
-              stellarNetwork,
-              rpcUrl,
-              councilPlatformUrl: url,
+              stellarNetwork: Deno.env.get('STELLAR_NETWORK'),
+              rpcUrl: Deno.env.get('RPC_URL'),
+              councilPlatformUrl: Deno.env.get('COUNCIL_PLATFORM_URL'),
             };
             Deno.writeTextFileSync('public/config.js',
               'window.__DASHBOARD_CONFIG__ = ' + JSON.stringify(config, null, 2) + ';\n');
-            console.log('Generated config.js pointing at', url);
+            console.log('Generated config.js');
           "
 
       - name: Build production bundle
         run: deno task build -- --production
 
       - name: Deploy to Tigris (mainnet)
         env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.MAINNET_TIGRIS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.MAINNET_TIGRIS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: "${{ secrets.MAINNET_TIGRIS_ACCESS_KEY_ID }}"
+          AWS_SECRET_ACCESS_KEY: "${{ secrets.MAINNET_TIGRIS_SECRET_ACCESS_KEY }}"
           AWS_REGION: auto
         run: |
           aws s3 sync public/ s3://mainnet-network-dashboard/ \

deno.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.2.6",
+  "version": "0.2.7",
   "license": "MIT",
   "tasks": {
     "dev": "deno run --allow-all --watch src/server.ts",