[Andreas-Garcia]

Summary

run-coolify-oneshot copied the env of the app's running container. A release that adds an env var therefore migrated without it: grow-api v14.1.x failed its prod migrations with KeyError: 'CURATION_API_KEY', because the running v14.0.0 container predates the key, even though Coolify already had it.

Changes

• New step that reads the app's runtime env from the Coolify API. It reuses the project → environment → application lookup that trigger-coolify-deploy uses.
  • It skips the is_preview mirror rows.
  • It uses value for literal vars, because Coolify returns their real_value shell-quoted.
  • It fails fast on multiline values.
• The env file is written with mode 600 on the runner, then scp'd to a mktemp file with mode 600 on the server. It never appears on a command line, and both copies are removed on exit.
• The running container still provides the Docker network.
• New required inputs: coolify_subdomain, domain, coolify_api_token. This is a minor bump to v4.6.0.
• README and CHANGELOG updated.

Test plan

• actionlint passes. shellcheck passes on every step script, except the existing ${{ }} expression in the unchanged known_hosts step.
• On the VPS, I generated the env from the API with this filter and compared it to the running containers, comparing hashes and key names only:
  • staging: 13/13 identical;
  • prod: identical apart from the new CURATION_API_KEY, which is the bug being fixed.
• First real run: the grow-api hotfix bump to @v4.6.0 (prod release-phase migrations).

🤖 Generated with Claude Code