From 843d31903feb32f76f9c51c51192ee7846898a84 Mon Sep 17 00:00:00 2001
From: Codebmk <belindamarion0@gmail.com>
Date: Sun, 7 Jun 2026 21:04:39 +0300
Subject: [PATCH 1/2] Pull Key Vault secrets into vertex .env

Add a "Pull secrets from Key Vault" step to the prod and staging frontend deployment workflows. Each step uses az keyvault secret show to retrieve the environment JSON (prod-env-vertex / sta-env-vertex), writes it to secrets.json, and converts it with jq into KEY=VALUE lines at src/vertex/.env before building and pushing the Docker image. This injects the Vertex service environment variables at build time using the repository's KEYVAULT and az/jq tooling.
---
 .github/workflows/deploy-frontend-to-azureprod.yml    | 9 +++++++++
 .github/workflows/deploy-frontend-to-azurestaging.yml | 9 +++++++++
 2 files changed, 18 insertions(+)

diff --git a/.github/workflows/deploy-frontend-to-azureprod.yml b/.github/workflows/deploy-frontend-to-azureprod.yml
index e8eb0094ff..107435646c 100644
--- a/.github/workflows/deploy-frontend-to-azureprod.yml
+++ b/.github/workflows/deploy-frontend-to-azureprod.yml
@@ -211,6 +211,15 @@ jobs:
       - name: ACR Login
         run: az acr login --name ${{ env.ACR_NAME }}
 
+      - name: Pull secrets from Key Vault
+        run: |
+          az keyvault secret show \
+            --vault-name ${{ env.KEYVAULT }} \
+            --name prod-env-vertex \
+            --query value -o tsv > secrets.json
+
+          jq -r 'to_entries | .[] | "\(.key)=\(.value|tojson)"' secrets.json > src/vertex/.env        
+
       - name: Build and Push Docker Image
         run: |
           cd src/vertex/
diff --git a/.github/workflows/deploy-frontend-to-azurestaging.yml b/.github/workflows/deploy-frontend-to-azurestaging.yml
index d84ec3a1cc..49ee1aec51 100644
--- a/.github/workflows/deploy-frontend-to-azurestaging.yml
+++ b/.github/workflows/deploy-frontend-to-azurestaging.yml
@@ -280,6 +280,15 @@ jobs:
       - name: ACR Login
         run: az acr login --name ${{ env.ACR_NAME }}
 
+      - name: Pull secrets from Key Vault
+        run: |
+          az keyvault secret show \
+            --vault-name ${{ env.KEYVAULT }} \
+            --name sta-env-vertex \
+            --query value -o tsv > secrets.json
+
+          jq -r 'to_entries | .[] | "\(.key)=\(.value|tojson)"' secrets.json > src/vertex/.env        
+
       - name: Build and Push Docker Image
         run: |
           cd src/vertex/

From ee408e886fd8b700e49534e3cfca69111747a224 Mon Sep 17 00:00:00 2001
From: Codebmk <belindamarion0@gmail.com>
Date: Sun, 7 Jun 2026 21:18:00 +0300
Subject: [PATCH 2/2] Pipe KeyVault output to jq; remove temp file

Stream `az keyvault secret show --query value -o tsv` directly into `jq` instead of writing to a temporary `secrets.json` file in the Azure deploy workflows. Updated both prod and staging workflows for the next-platform and vertex secret steps so they write directly to `src/platform/.env` and `src/vertex/.env`. This simplifies the steps and removes unnecessary file I/O without changing behavior.
---
 .github/workflows/deploy-frontend-to-azureprod.yml    | 10 ++++------
 .github/workflows/deploy-frontend-to-azurestaging.yml | 10 ++++------
 2 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/deploy-frontend-to-azureprod.yml b/.github/workflows/deploy-frontend-to-azureprod.yml
index 107435646c..24c4e8b68f 100644
--- a/.github/workflows/deploy-frontend-to-azureprod.yml
+++ b/.github/workflows/deploy-frontend-to-azureprod.yml
@@ -170,9 +170,8 @@ jobs:
           az keyvault secret show \
             --vault-name ${{ env.KEYVAULT }} \
             --name prod-env-next-platform \
-            --query value -o tsv > secrets.json
-
-          jq -r 'to_entries | .[] | "\(.key)=\(.value|tojson)"' secrets.json > src/platform/.env        
+            --query value -o tsv | \
+          jq -r 'to_entries | .[] | "\(.key)=\(.value|tojson)"' > src/platform/.env        
 
       - name: Build and Push Docker Image
         run: |
@@ -216,9 +215,8 @@ jobs:
           az keyvault secret show \
             --vault-name ${{ env.KEYVAULT }} \
             --name prod-env-vertex \
-            --query value -o tsv > secrets.json
-
-          jq -r 'to_entries | .[] | "\(.key)=\(.value|tojson)"' secrets.json > src/vertex/.env        
+            --query value -o tsv | \
+          jq -r 'to_entries | .[] | "\(.key)=\(.value|tojson)"' > src/vertex/.env        
 
       - name: Build and Push Docker Image
         run: |
diff --git a/.github/workflows/deploy-frontend-to-azurestaging.yml b/.github/workflows/deploy-frontend-to-azurestaging.yml
index 49ee1aec51..22b31badbd 100644
--- a/.github/workflows/deploy-frontend-to-azurestaging.yml
+++ b/.github/workflows/deploy-frontend-to-azurestaging.yml
@@ -238,9 +238,8 @@ jobs:
           az keyvault secret show \
             --vault-name ${{ env.KEYVAULT }} \
             --name sta-env-next-platform \
-            --query value -o tsv > secrets.json
-
-          jq -r 'to_entries | .[] | "\(.key)=\(.value|tojson)"' secrets.json > src/platform/.env        
+            --query value -o tsv | \
+          jq -r 'to_entries | .[] | "\(.key)=\(.value|tojson)"' > src/platform/.env        
 
       - name: Build and Push Docker Image
         run: |
@@ -285,9 +284,8 @@ jobs:
           az keyvault secret show \
             --vault-name ${{ env.KEYVAULT }} \
             --name sta-env-vertex \
-            --query value -o tsv > secrets.json
-
-          jq -r 'to_entries | .[] | "\(.key)=\(.value|tojson)"' secrets.json > src/vertex/.env        
+            --query value -o tsv | \
+          jq -r 'to_entries | .[] | "\(.key)=\(.value|tojson)"' > src/vertex/.env        
 
       - name: Build and Push Docker Image
         run: |