chore(deploy): wire OPENAI_API_KEY + LLM_ENABLED for LLM chat activation (#960) #1178

Merged

bot-backend merged 1 commit from chore/deploy-llm-env-960 into main

2026-06-09 08:55:19 +00:00

bot-backend commented

2026-06-09 08:52:36 +00:00

Collaborator

Summary

Wires OPENAI_API_KEY + LLM_ENABLED into the prod deploy so the LLM chat (#960/#957) can be activated by setting two Forgejo Actions values — no code change, no literal key.

OPENAI_API_KEY (Forgejo secret, sensitive) + LLM_ENABLED (Forgejo variable, bool) → forwarded into the SSH deploy (env: + envs: list) → written to backend/.env.runtime (shared by backend+worker+beat), mirroring the existing OBJECTIVE_API_KEY wiring.
Dormant-by-default (hard shell guard): each .env.runtime write is wrapped in [ -n "${VAR:-}" ], so an UNSET secret/var writes nothing → app keeps llm_enabled=False / openai_api_key=None. The LLM path can't activate accidentally — both must be deliberately set.
No literal key (only ${{ secrets.* }} / ${{ vars.* }} refs). Compose header documents both as optional.

Test plan

YAML parses (yaml.safe_load both files); remote script: passes sh -n (POSIX syntax)
all 3 wiring sites present (env block / envs: list / .env.runtime write) — no silent drop-to-remote
conditional writes verified dormant-safe under set -euo pipefail (${VAR:-} default)
no regression to other deploy steps (only the envs: line changed + new blocks appended); no literal secret
code-reviewer ✅ APPROVE (all 7 focus points clean)

To activate (your action — I can't set secrets/keys)

Forgejo repo → Settings → Actions:

Secrets → OPENAI_API_KEY = <the test key>
Variables → LLM_ENABLED = true

Activates on the next deploy. Until both set → chat keeps working on the deterministic path. (Note: merging THIS PR triggers a deploy that runs the new wiring; with the secrets unset it writes nothing → still dormant.)

Refs #960

## Summary Wires `OPENAI_API_KEY` + `LLM_ENABLED` into the prod deploy so the LLM chat (#960/#957) can be **activated by setting two Forgejo Actions values** — no code change, no literal key. - `OPENAI_API_KEY` (Forgejo **secret**, sensitive) + `LLM_ENABLED` (Forgejo **variable**, bool) → forwarded into the SSH deploy (`env:` + `envs:` list) → written to `backend/.env.runtime` (shared by backend+worker+beat), mirroring the existing `OBJECTIVE_API_KEY` wiring. - **Dormant-by-default (hard shell guard):** each `.env.runtime` write is wrapped in `[ -n "${VAR:-}" ]`, so an UNSET secret/var writes **nothing** → app keeps `llm_enabled=False` / `openai_api_key=None`. The LLM path can't activate accidentally — both must be deliberately set. - No literal key (only `${{ secrets.* }}` / `${{ vars.* }}` refs). Compose header documents both as optional. ## Test plan - [x] YAML parses (`yaml.safe_load` both files); remote `script:` passes `sh -n` (POSIX syntax) - [x] all 3 wiring sites present (env block / `envs:` list / `.env.runtime` write) — no silent drop-to-remote - [x] conditional writes verified dormant-safe under `set -euo pipefail` (`${VAR:-}` default) - [x] no regression to other deploy steps (only the `envs:` line changed + new blocks appended); no literal secret - [x] code-reviewer ✅ APPROVE (all 7 focus points clean) ## To activate (your action — I can't set secrets/keys) Forgejo repo → **Settings → Actions**: - **Secrets** → `OPENAI_API_KEY` = `<the test key>` - **Variables** → `LLM_ENABLED` = `true` Activates on the next deploy. Until both set → chat keeps working on the deterministic path. (Note: merging THIS PR triggers a deploy that runs the new wiring; with the secrets unset it writes nothing → still dormant.) Refs #960

bot-backend added 1 commit 2026-06-09 08:52:37 +00:00

chore(deploy): wire OPENAI_API_KEY + LLM_ENABLED into prod env for LLM chat

CI / changes (push) Successful in 6s

Details

CI / backend-tests (push) Has been skipped

Details

CI / frontend-tests (push) Has been skipped

Details

CI / changes (pull_request) Successful in 5s

Details

CI / backend-tests (pull_request) Has been skipped

Details

CI / frontend-tests (pull_request) Has been skipped

Details

Deploy / changes (push) Successful in 5s

Details

Deploy / build-worker (push) Successful in 28s

Details

Deploy / build-backend (push) Successful in 30s

Details

Deploy / build-frontend (push) Successful in 28s

Details

Deploy / deploy (push) Successful in 1m1s

Details

98ecdecb5b

Forward OPENAI_API_KEY (Forgejo secret) and LLM_ENABLED (Forgejo actions
variable) into the SSH deploy and write them to backend/.env.runtime ONLY
when non-empty, so the LLM chat (#960/#957) stays dormant
(llm_enabled=False, openai_api_key=None) until BOTH are set in Forgejo.
Mirrors the OBJECTIVE_API_KEY wiring (env block + envs list + idempotent
.env.runtime grep-sed-or-printf), but guarded by [ -n ] so an unset
secret/var writes nothing. No literal key (refs only). Compose header
documents both as optional. .env.runtime is shared by backend+worker+beat.

Refs #960