Patina-Network · naanci · Aug 15, 2026 · Aug 15, 2026 · Aug 15, 2026
diff --git a/.github/composite/build-image/action.yml b/.github/composite/build-image/action.yml
@@ -27,8 +27,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
-        GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
-        GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
+        SECRETS: ${{ toJSON(secrets) }}
 
     - name: Set up pnpm
       uses: pnpm/action-setup@v5

diff --git a/.github/composite/build-image/internal/standup-bot/action.yml b/.github/composite/build-image/internal/standup-bot/action.yml
@@ -24,8 +24,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
-        GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
-        GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
+        SECRETS: ${{ toJSON(secrets) }}
 
     - name: Set up OpenJDK 25
       uses: actions/setup-java@v5

diff --git a/.github/composite/deploy-standup-bot/action.yaml b/.github/composite/deploy-standup-bot/action.yaml
@@ -19,8 +19,7 @@ runs:
       id: build-image
       uses: ./.github/composite/build-image/internal/standup-bot
       with:
-        GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
-        GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
+        SECRETS: ${{ toJSON(secrets) }}
 
     - name: Deploy standup-bot image tag
       shell: bash

diff --git a/.github/composite/notion-checks/action.yml b/.github/composite/notion-checks/action.yml
@@ -31,8 +31,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
-        GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
-        GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
+        SECRETS: ${{ toJSON(secrets) }}
 
     - name: Run script
       id: run_script

diff --git a/.github/composite/redeploy/action.yml b/.github/composite/redeploy/action.yml
@@ -22,8 +22,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
-        GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
-        GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
+        SECRETS: ${{ toJSON(secrets) }}
 
     - name: Set up pnpm
       uses: pnpm/action-setup@v5

diff --git a/.github/composite/redeploy/internal/standup-bot/action.yml b/.github/composite/redeploy/internal/standup-bot/action.yml
@@ -15,8 +15,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
-        GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
-        GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
+        SECRETS: ${{ toJSON(secrets) }}
 
     - name: Expose GitHub Runtime
       uses: crazy-max/ghaction-github-runtime@v4

diff --git a/.github/composite/setup-ci/action.yml b/.github/composite/setup-ci/action.yml
@@ -12,6 +12,9 @@ inputs:
     description: "GitHub token used to send message"
     required: false
     default: ${{ github.token }}
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
 
 runs:
   using: "composite"

diff --git a/.github/composite/test/backend-test/action.yml b/.github/composite/test/backend-test/action.yml
@@ -2,12 +2,9 @@ name: "Backend test"
 description: "Run backend tests"
 
 inputs:
-  GPG_PRIVATE_KEY:
-    description: "GPG Private Key"
-    required: true
-  GPG_PASSPHRASE:
-    description: "GPG Passphrase"
-    required: true
+  SECRETS:
+    description: "Pass toJSON(secrets) from the calling workflow to expose all secrets as env vars."
+    required: false
   UPLOAD_TEST_COV:
     description: "Boolean indicating whether tests should be uploaded to our code coverage provider or not."
     required: false
@@ -19,8 +16,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
-        GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
-        GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
+        SECRETS: ${{ toJSON(secrets) }}
 
     - name: Set up pnpm
       uses: pnpm/action-setup@v5

diff --git a/.github/composite/test/frontend-pre-test/action.yml b/.github/composite/test/frontend-pre-test/action.yml
@@ -15,8 +15,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
-        GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
-        GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
+        SECRETS: ${{ toJSON(secrets) }}
 
     - name: Set up OpenJDK 25
       uses: actions/setup-java@v5

diff --git a/.github/composite/test/frontend-test/action.yml b/.github/composite/test/frontend-test/action.yml
@@ -19,8 +19,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
-        GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
-        GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
+        SECRETS: ${{ toJSON(secrets) }}
 
     - name: Set up pnpm
       uses: pnpm/action-setup@v5

diff --git a/.github/composite/validate-db/action.yml b/.github/composite/validate-db/action.yml
@@ -22,8 +22,7 @@ runs:
     - name: Setup CI
       uses: ./.github/composite/setup-ci
       with:
-        GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
-        GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
+        SECRETS: ${{ toJSON(secrets) }}
 
     - name: Set up OpenJDK 25
       uses: actions/setup-java@v5

diff --git a/.github/scripts/auto-approval/index.ts b/.github/scripts/auto-approval/index.ts
@@ -1,6 +1,5 @@
 import type { RestEndpointMethodTypes } from "@octokit/rest";
 
-import { getEnvVariables } from "load-secrets/env/load";
 import { checkNotionPrAndGetTask } from "notion/pr";
 import { getNotionClient } from "notion/sdk";
 import { Octokit } from "octokit";
@@ -34,7 +33,7 @@ const {
   .strict()
   .parse();
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const notionDbId = (() => {
     const v = ciEnv["NOTION_TASK_DB_ID"];
     if (!v) {
@@ -57,7 +56,7 @@ function parseCiEnv(ciEnv: Record<string, string>) {
   };
 }
 
-const { notionDbId, notionSecret } = parseCiEnv(await getEnvVariables(["ci"]));
+const { notionDbId, notionSecret } = parseCiEnv(process.env);
 const notionClient = getNotionClient(notionSecret);
 
 const taskAndPr = await checkNotionPrAndGetTask(notionClient, prId, notionDbId);

diff --git a/.github/scripts/build-image/index.ts b/.github/scripts/build-image/index.ts
@@ -40,8 +40,7 @@ const serverProfiles = environment === "staging" ? "stg" : "prod";
 
 async function main() {
   try {
-    const ciEnv = await getEnvVariables(["ci"]);
-    const { dockerHubPat } = parseCiEnv(ciEnv);
+    const { dockerHubPat } = parseCiEnv(process.env);
     const localDbEnv = await db.start();
     const ciAppEnv = await getEnvVariables(["ci-app"]);
 
@@ -126,7 +125,7 @@ async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const dockerHubPat = (() => {
     const v = ciEnv["DOCKER_HUB_PAT"];
     if (!v) {

diff --git a/.github/scripts/build-image/internal/standup-bot.ts b/.github/scripts/build-image/internal/standup-bot.ts
@@ -1,5 +1,4 @@
 import { $ } from "bun";
-import { getEnvVariables } from "load-secrets/env/load";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 
@@ -27,8 +26,7 @@ const { dockerUpload, getGhaOutput, githubOutputFile } = await yargs(
   .parse();
 
 async function main() {
-  const ciEnv = await getEnvVariables(["ci"]);
-  const { dockerHubPat } = parseCiEnv(ciEnv);
+  const { dockerHubPat } = parseCiEnv(process.env);
 
   // copy old tz format from build-image.sh
   const timestamp = new Date()
@@ -94,7 +92,7 @@ async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const dockerHubPat = (() => {
     const v = ciEnv["DOCKER_HUB_PAT"];
     if (!v) {

diff --git a/.github/scripts/deploy/index.ts b/.github/scripts/deploy/index.ts
@@ -1,7 +1,7 @@
 import type { Environment } from "@tahminator/pipeline";
 import type { Type } from "types";
 
-import { GitHubClient, Utils } from "@tahminator/pipeline";
+import { GitHubClient } from "@tahminator/pipeline";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 
@@ -24,8 +24,7 @@ const { environment, newTagVersion, type } = await yargs(hideBin(process.argv))
   .parse();
 
 async function main() {
-  const ciEnv = await Utils.getEnvVariables(["ci"]);
-  const { ghPat } = parseCiEnv(ciEnv);
+  const { ghPat } = parseCiEnv(process.env);
   const ghClient = new GitHubClient(ghPat);
 
   if (type === "web") {
@@ -51,7 +50,7 @@ async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const ghPat = (() => {
     const v = ciEnv["GH_PAT"];
     if (!v) {

diff --git a/.github/scripts/notion/index.ts b/.github/scripts/notion/index.ts
@@ -1,4 +1,3 @@
-import { getEnvVariables } from "load-secrets/env/load";
 import { _checkCommits } from "notion/commits";
 import { checkNotionPrAndGetTask } from "notion/pr";
 import { _validateNotionTask } from "notion/pr/validate-ticket";
@@ -42,9 +41,7 @@ const {
 async function main() {
   console.log(`GET_GHA_OUTPUT=${getGhaOutput}`);
 
-  const { notionDbId, notionSecret } = parseCiEnv(
-    await getEnvVariables(["ci"]),
-  );
+  const { notionDbId, notionSecret } = parseCiEnv(process.env);
   const client = getNotionClient(notionSecret);
 
   const { taskId, taskContent, task, taskPublicUrl } =
@@ -72,7 +69,7 @@ async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const notionDbId = (() => {
     const v = ciEnv["NOTION_TASK_DB_ID"];
     if (!v) {

diff --git a/.github/scripts/redeploy/internal/standup-bot/index.ts b/.github/scripts/redeploy/internal/standup-bot/index.ts
@@ -11,9 +11,7 @@ async function main() {
   // await $`git-crypt unlock`;
 
   const { bearerAuth, serverUrl, projectUuid, serverUuid } = parseCiEnv(
-    await getEnvVariables(["ci"], {
-      baseDir: "internal",
-    }),
+    process.env,
   );
 
   const client = await initClient(bearerAuth, serverUrl);
@@ -74,7 +72,7 @@ async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const bearerAuth = (() => {
     const v = ciEnv["COOLIFY_BEARER_AUTH"];
     if (!v) {

diff --git a/.github/scripts/test/run-backend-tests.ts b/.github/scripts/test/run-backend-tests.ts
@@ -44,8 +44,7 @@ async function main() {
     await $$`./mvnw clean verify -Dspring.profiles.active=ci`;
 
     if (shouldUploadCoverage) {
-      const ciEnv = await getEnvVariables(["ci"]);
-      const { sonarToken } = parseCiEnv(ciEnv);
+      const { sonarToken } = parseCiEnv(process.env);
       await uploadBackendTests(sonarToken);
     }
   } finally {
@@ -55,7 +54,7 @@ async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const sonarToken = (() => {
     const v = ciEnv["SONAR_TOKEN"];
     if (!v) {

diff --git a/.github/scripts/test/run-e2e-tests.ts b/.github/scripts/test/run-e2e-tests.ts
@@ -20,9 +20,7 @@ const { actionUrl, skipDiscordMessage } = await yargs(hideBin(process.argv))
   .parse();
 
 async function main() {
-  const { discordToken, discordChannelId } = parseCiEnv(
-    await getEnvVariables(["ci"]),
-  );
+  const { discordToken, discordChannelId } = parseCiEnv(process.env);
   try {
     const ciAppEnv = await getEnvVariables(["ci-app"]);
 
@@ -81,7 +79,7 @@ main()
     process.exit(1);
   });
 
-function parseCiEnv(env: Record<string, string>) {
+function parseCiEnv(env: Record<string, string | undefined>) {
   const discordToken = env["DISCORD_TOKEN"];
   if (!discordToken) {
     throw new Error("Missing DISCORD_TOKEN from .env.ci");

diff --git a/.github/scripts/test/run-frontend-tests.ts b/.github/scripts/test/run-frontend-tests.ts
@@ -30,8 +30,7 @@ async function main() {
     await $$`pnpm --dir js run test`;
 
     if (shouldUploadCoverage) {
-      const ciEnv = await getEnvVariables(["ci"]);
-      const { sonarToken } = parseCiEnv(ciEnv);
+      const { sonarToken } = parseCiEnv(process.env);
 
       await uploadFrontendTests(sonarToken);
     }
@@ -41,7 +40,7 @@ async function main() {
   }
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
+function parseCiEnv(ciEnv: Record<string, string | undefined>) {
   const sonarToken = (() => {
     const v = ciEnv["SONAR_TOKEN"];
     if (!v) {

diff --git a/.github/workflows/ai-command.yml b/.github/workflows/ai-command.yml
@@ -61,14 +61,12 @@ jobs:
       - name: Setup CI
         uses: ./.github/composite/setup-ci
         with:
-          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+          SECRETS: ${{ toJSON(secrets) }}
 
       - name: Load secrets
         uses: ./.github/composite/load-secrets
         with:
-          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+          SECRETS: ${{ toJSON(secrets) }}
           UNLOAD_ENVIRONMENTS: ci
 
       - name: Post /review command

diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
@@ -58,23 +58,20 @@ jobs:
       - name: Setup CI
         uses: ./.github/composite/setup-ci
         with:
-          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+          SECRETS: ${{ toJSON(secrets) }}
 
       - name: Load secrets
         uses: ./.github/composite/load-secrets
         with:
-          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+          SECRETS: ${{ toJSON(secrets) }}
           UNLOAD_ENVIRONMENTS: ci
 
       - name: Run composite workflow
         uses: ./.github/composite/notion-checks
         id: notion_check
         with:
           PR_ID: ${{ github.event.number || github.event.issue.number  }}
-          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+          SECRETS: ${{ toJSON(secrets) }}
           GET_GHA_OUTPUT: "true"
           VALIDATE_TICKET: "false"