From 833adcd8fa862bd3c9409c3b827cf635c7cd452d Mon Sep 17 00:00:00 2001
From: Esdras Renan <monkeyesdras@gmail.com>
Date: Thu, 9 Oct 2025 18:49:50 -0300
Subject: [PATCH] ci(convex): garantir que .env nao esteja presente e unset
 CONVEX_DEPLOYMENT no deploy\n\n- Sempre exclui .env* no rsync do job do
 Convex e renomeia .env se restar.\n- Exporta CI=true e faz unset de
 CONVEX_DEPLOYMENT dentro do container.\n- Evita conflito entre self-hosted
 (URL+ADMIN_KEY) e CONVEX_DEPLOYMENT.

---
 .github/workflows/ci-cd-web-desktop.yml | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci-cd-web-desktop.yml b/.github/workflows/ci-cd-web-desktop.yml
index 2875928..965f389 100644
--- a/.github/workflows/ci-cd-web-desktop.yml
+++ b/.github/workflows/ci-cd-web-desktop.yml
@@ -208,29 +208,31 @@ jobs:
         run: |
           mkdir -p "$EFFECTIVE_APP_DIR"
           RSYNC_FLAGS="-az --inplace --no-times --no-perms --no-owner --no-group --delete"
-          EXCLUDE_ENV="--exclude '.env*' --exclude 'apps/desktop/.env*' --exclude 'convex/.env*'"
-          if [ "$EFFECTIVE_APP_DIR" != "${APP_DIR:-/srv/apps/sistema}" ]; then
-            EXCLUDE_ENV=""
-          fi
           rsync $RSYNC_FLAGS \
             --filter='protect .next.old*' \
             --exclude '.next.old*' \
+            --exclude '.env*' \
+            --exclude 'apps/desktop/.env*' \
+            --exclude 'convex/.env*' \
             --filter='protect node_modules' \
             --filter='protect node_modules/**' \
             --filter='protect .pnpm-store' \
             --filter='protect .pnpm-store/**' \
-            --filter='protect .env' \
-            --filter='protect .env*' \
-            --filter='protect apps/desktop/.env*' \
-            --filter='protect convex/.env*' \
             --exclude '.git' \
             --exclude '.next' \
             --exclude 'node_modules' \
             --exclude 'node_modules/**' \
             --exclude '.pnpm-store' \
             --exclude '.pnpm-store/**' \
-            $EXCLUDE_ENV \
             ./ "$EFFECTIVE_APP_DIR"/
+
+      - name: Ensure .env is not present for Convex deploy
+        run: |
+          cd "$EFFECTIVE_APP_DIR"
+          if [ -f .env ]; then
+            echo "Renaming .env -> .env.bak (Convex self-hosted deploy)"
+            mv -f .env .env.bak
+          fi
       - name: Deploy functions to Convex self-hosted
         if: ${{ env.CONVEX_SELF_HOSTED_URL != '' && env.CONVEX_SELF_HOSTED_ADMIN_KEY != '' }}
         env:
@@ -240,9 +242,10 @@ jobs:
           docker run --rm -i \
             -v "$EFFECTIVE_APP_DIR":/app \
             -w /app \
+            -e CI=true \
             -e CONVEX_SELF_HOSTED_URL \
             -e CONVEX_SELF_HOSTED_ADMIN_KEY \
-            node:20-bullseye bash -lc "corepack enable && corepack prepare pnpm@9 --activate && pnpm install --frozen-lockfile --prod=false && pnpm exec convex deploy"
+            node:20-bullseye bash -lc "set -euo pipefail; unset CONVEX_DEPLOYMENT; corepack enable; corepack prepare pnpm@9 --activate; pnpm install --frozen-lockfile --prod=false; pnpm exec convex deploy"
 
   desktop_release:
     name: Desktop Release (Windows)