From 3e853a92429a985e891c64722c8cda995cc3fd43 Mon Sep 17 00:00:00 2001
From: Shalom Arhebamen <arhebs@outlook.com>
Date: Sat, 2 May 2026 07:53:05 +0300
Subject: [PATCH] fix(core): allow drop without runtime secret

---
 .changeset/breezy-runtime-drops.md       |  7 +++++++
 packages/core/src/operations/db-hook.ts  | 17 ++++++++++++++---
 tests/overlay-lifecycle-contract.test.ts | 10 ++++++++++
 3 files changed, 31 insertions(+), 3 deletions(-)
 create mode 100644 .changeset/breezy-runtime-drops.md

diff --git a/.changeset/breezy-runtime-drops.md b/.changeset/breezy-runtime-drops.md
new file mode 100644
index 0000000..651a297
--- /dev/null
+++ b/.changeset/breezy-runtime-drops.md
@@ -0,0 +1,7 @@
+---
+"@tsops/core": patch
+"tsops": patch
+---
+
+Do not require generated runtime database Secrets for built-in drop-schema jobs;
+the drop SQL only needs lifecycle credentials and resolved metadata.
diff --git a/packages/core/src/operations/db-hook.ts b/packages/core/src/operations/db-hook.ts
index ef79b6e..82ac2a1 100644
--- a/packages/core/src/operations/db-hook.ts
+++ b/packages/core/src/operations/db-hook.ts
@@ -217,7 +217,8 @@ export async function runDatabasePostDestroy(
     lifecycleSecret,
     vars,
     schema,
-    sqlSteps: buildDropSchemaSqlSteps(database, vars, schema)
+    sqlSteps: buildDropSchemaSqlSteps(database, vars, schema),
+    includeRuntimeSecretEnv: false
   })
   await kubectl.apply(job, { namespace })
   return { jobName }
@@ -455,8 +456,18 @@ function renderPsqlJob(input: {
   vars: OverlayVars
   schema: string
   sqlSteps: string[]
+  includeRuntimeSecretEnv?: boolean
 }): SupportedManifest {
-  const { namespace, name, database, lifecycleSecret, vars, schema, sqlSteps } = input
+  const {
+    namespace,
+    name,
+    database,
+    lifecycleSecret,
+    vars,
+    schema,
+    sqlSteps,
+    includeRuntimeSecretEnv = true
+  } = input
   const sql = shellDoubleQuoted(sqlSteps.join('; '))
 
   const job = {
@@ -490,7 +501,7 @@ function renderPsqlJob(input: {
                   }
                 },
                 ...renderDatabaseMetadataEnv(database, vars, schema),
-                ...renderRuntimeSecretEnv(database, vars)
+                ...(includeRuntimeSecretEnv ? renderRuntimeSecretEnv(database, vars) : [])
               ]
             }
           ]
diff --git a/tests/overlay-lifecycle-contract.test.ts b/tests/overlay-lifecycle-contract.test.ts
index 0d0672c..c1f936a 100644
--- a/tests/overlay-lifecycle-contract.test.ts
+++ b/tests/overlay-lifecycle-contract.test.ts
@@ -677,6 +677,12 @@ describe('overlay lifecycle preview contract', () => {
 
     const job = applied(kubectl, 'Job', 'tsops-db-drop-pr-857')[0] as any
     const command = job.spec.template.spec.containers[0].args[0] as string
+    const env = Object.fromEntries(
+      job.spec.template.spec.containers[0].env.map((item: any) => [
+        item.name,
+        item.value ?? item.valueFrom
+      ])
+    )
 
     expect(command).toContain('pg_depend')
     expect(command).toContain('cross-schema dependencies')
@@ -691,6 +697,10 @@ describe('overlay lifecycle preview contract', () => {
     )
     expect(command).toContain('DROP SCHEMA IF EXISTS \\"pr_857\\" CASCADE')
     expect(command).toContain('DROP ROLE IF EXISTS \\"worken_pr_857_app\\"')
+    expect(env.DATABASE_RUNTIME_ROLE).toBe('worken_pr_857_app')
+    expect(env.DATABASE_RUNTIME_SECRET_NAME).toBe('pr-857-db-app')
+    expect(env.DATABASE_RUNTIME_URL).toBeUndefined()
+    expect(env.DATABASE_RUNTIME_PASSWORD).toBeUndefined()
     expect(kubectl.waited).toContainEqual({
       name: 'tsops-db-drop-pr-857',
       namespace: 'pr-857',