[vcarl]

Summary

The deploy job passed ${{ secrets.* }} unquoted on the kubectl create secret --from-literal command line, so a secret value containing shell metacharacters could break or inject into the step, and it deleted the Secret before recreating it, leaving a window with no reactibot-env.

• Secrets now come through env: and are applied with kubectl create secret generic ... --dry-run=client -o yaml | kubectl apply -f - (no delete, same keys).
• matootie/dokube is pinned to a commit SHA.

Pre-existing, not changed here: || echo \n still masks Secret failures, and older action versions that actionlint flags.

Testing

• actionlint: no new findings (pre-existing warnings listed above)
• secrets. appears only in env: / with:
• First real run: next deploy from main

🤖 Generated with Claude Code

https://claude.ai/code/session_01VgoAF3w3BoRS7iBL2ShRXM

[Copilot]

Note

Copilot was unable to complete this review at the selected tier due to model policy or plan restrictions.

🔵 Needs a closer look

Because the change alters production deployment secret creation/update behavior, it requires a maintainer with deploy access to validate it via a real deployment run to ensure Secrets update correctly and avoid downtime or regressions.

No open issues 🎉

What changed in this PR

Hardens the GitHub Actions Kubernetes deploy workflow by sourcing secrets via environment variables and updating the target Secret in-place to avoid a delete/recreate gap.

Changes:

• Pass deploy secrets through env: and build the secret inputs from environment variables.
• Replace Secret delete + create with kubectl create ... --dry-run=client -o yaml | kubectl apply -f - to eliminate the missing-Secret window.
• Pin matootie/dokube to a specific commit SHA.

File	Description
.github/​workflows/​node.js.yml	Updates the deploy workflow to consume secrets via env variables, apply the Kubernetes Secret declaratively without delete/recreate, and pin the dokube action to a commit SHA.

_{Review effort: Balanced}