Changeset 0.9.4 (#54)

.gitea/workflows/ci.yaml

@@ -1,6 +1,6 @@
 # .gitea/workflows/ci.yaml
 # ============================================
-# Chat Switchboard - CI/CD Pipeline (v0.9.0)
+# Chat Switchboard - CI/CD Pipeline (v0.9.4)
 # ============================================
 # Cluster deployments use SEPARATE FE + BE images.
 # Unified image is for Docker Hub only (docker-compose use).
@@ -36,6 +36,7 @@
 #   POSTGRES_USER, POSTGRES_PASSWORD
 #   POSTGRES_ADMIN_USER, POSTGRES_ADMIN_PASSWORD
 #   SWITCHBOARD_ADMIN_USERNAME, SWITCHBOARD_ADMIN_PASSWORD, SWITCHBOARD_ADMIN_EMAIL
+#   ENCRYPTION_KEY — AES-256 key for API key encryption (openssl rand -base64 32)
 #   VENICE_API_KEY (live provider integration tests — optional, tests skip if missing)
 #   DOCKERHUB_USERNAME, DOCKERHUB_TOKEN (optional)
 #
@@ -416,6 +417,7 @@ jobs:
           SW_ADMIN_PASS: ${{ secrets.SWITCHBOARD_ADMIN_PASSWORD }}
           SW_ADMIN_EMAIL: ${{ secrets.SWITCHBOARD_ADMIN_EMAIL }}
           SEED_USERS: ${{ vars.SEED_USERS }}
+          ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
         run: |
           kubectl create secret generic switchboard-db-credentials \
             --namespace=${NAMESPACE} \
@@ -435,6 +437,11 @@ jobs:
             --from-literal=users="${SEED_USERS}" \
             --dry-run=client -o yaml | kubectl apply -f -
 
+          kubectl create secret generic switchboard-encryption \
+            --namespace=${NAMESPACE} \
+            --from-literal=ENCRYPTION_KEY="${ENCRYPTION_KEY}" \
+            --dry-run=client -o yaml | kubectl apply -f -
+
       - name: Render and apply manifests
         env:
           ENVIRONMENT: ${{ steps.env.outputs.ENVIRONMENT }}