Joel Brock
586cf14e75
Without this, even after setting STAFF_REPORT_KEY in the Amplify Secrets tab the value never reaches the SSR Lambda — the build script only writes the listed env vars into .env.production, which is what Next bundles.
92 lines
4.3 KiB
YAML
92 lines
4.3 KiB
YAML
version: 1
|
|
applications:
|
|
- frontend:
|
|
phases:
|
|
preBuild:
|
|
commands:
|
|
- nvm use $(cat .nvmrc) || nvm install $(cat .nvmrc)
|
|
# --include=dev is required because the build needs PostCSS /
|
|
# Tailwind plugins which live in devDependencies; without it,
|
|
# NODE_ENV=production in the Amplify env causes npm to skip them.
|
|
- npm ci --include=dev --cache .npm --prefer-offline
|
|
# Amplify exposes Environment Variables in the build shell as
|
|
# plain `$VAR` references, but Secrets are SecureString entries
|
|
# in SSM Parameter Store at `/amplify/<appId>/<branch>/<name>`
|
|
# and are NOT always injected automatically into the build
|
|
# shell on older build images. If a Secret is unset as an env
|
|
# var, fall back to fetching it from SSM directly.
|
|
#
|
|
# Once resolved, the values get baked into .env.production so
|
|
# Next bundles them into the SSR Lambda. .env* is gitignored.
|
|
- |
|
|
# Try SSM for any of these that arrive empty (they were set
|
|
# via the Amplify Secrets tab, not Environment variables).
|
|
# Requires the Amplify build role to have ssm:GetParameter on
|
|
# /amplify/$AWS_APP_ID/$AWS_BRANCH/* — granted by default.
|
|
fetch_secret() {
|
|
local name="$1"
|
|
local current="${!name}"
|
|
if [ -n "$current" ]; then return 0; fi
|
|
local path="/amplify/${AWS_APP_ID}/${AWS_BRANCH}/${name}"
|
|
local val
|
|
val=$(aws ssm get-parameter --name "$path" --with-decryption \
|
|
--query "Parameter.Value" --output text 2>/dev/null || true)
|
|
if [ -n "$val" ] && [ "$val" != "None" ]; then
|
|
export "$name=$val"
|
|
echo "[secrets] $name resolved from SSM ($path)"
|
|
fi
|
|
}
|
|
for v in CIVI_API_KEY CIVI_SITE_KEY CIVI_HTTP_AUTH_PASS HEALTH_TOKEN PREVIEW_ADMIN_TOKEN STAFF_REPORT_KEY; do
|
|
fetch_secret "$v"
|
|
done
|
|
- |
|
|
# Length-only diagnostic (no values leaked to the log).
|
|
for v in CIVI_BASE_URL CIVI_API_KEY CIVI_SITE_KEY CIVI_HTTP_AUTH_USER CIVI_HTTP_AUTH_PASS HEALTH_TOKEN PREVIEW_ADMIN_TOKEN STAFF_REPORT_KEY; do
|
|
val="${!v}"
|
|
if [ -n "$val" ]; then
|
|
echo "[env check] $v set (${#val} chars)"
|
|
else
|
|
echo "[env check] $v UNSET"
|
|
fi
|
|
done
|
|
- |
|
|
# Required-vars guard. Fails the build now (with a clear
|
|
# message) instead of letting an empty .env.production crash
|
|
# the SSR Lambda at runtime with "Refusing to run in
|
|
# production" from lib/env.ts.
|
|
missing=""
|
|
for v in CIVI_BASE_URL CIVI_API_KEY CIVI_SITE_KEY; do
|
|
if [ -z "${!v}" ]; then missing="$missing $v"; fi
|
|
done
|
|
if [ -n "$missing" ]; then
|
|
echo "::error::Amplify build env missing required vars:$missing"
|
|
echo "Confirm: (1) the var is in the Amplify console under either"
|
|
echo "Hosting → Environment variables OR Hosting → Secrets;"
|
|
echo "(2) it is scoped to branch '${AWS_BRANCH}' (or All branches);"
|
|
echo "(3) the Amplify build role can read /amplify/${AWS_APP_ID}/${AWS_BRANCH}/* from SSM."
|
|
exit 1
|
|
fi
|
|
- |
|
|
{
|
|
echo "CIVI_BASE_URL=$CIVI_BASE_URL"
|
|
echo "CIVI_API_KEY=$CIVI_API_KEY"
|
|
echo "CIVI_SITE_KEY=$CIVI_SITE_KEY"
|
|
echo "CIVI_HTTP_AUTH_USER=$CIVI_HTTP_AUTH_USER"
|
|
echo "CIVI_HTTP_AUTH_PASS=$CIVI_HTTP_AUTH_PASS"
|
|
echo "HEALTH_TOKEN=$HEALTH_TOKEN"
|
|
echo "PREVIEW_ADMIN_TOKEN=$PREVIEW_ADMIN_TOKEN"
|
|
echo "STAFF_REPORT_KEY=$STAFF_REPORT_KEY"
|
|
} > .env.production
|
|
build:
|
|
commands:
|
|
- npm run build
|
|
artifacts:
|
|
baseDirectory: .next
|
|
files:
|
|
- '**/*'
|
|
cache:
|
|
paths:
|
|
- node_modules/**/*
|
|
- .next/cache/**/*
|
|
- .npm/**/*
|