Update client env handling

Author: arkid15r

.github/workflows/run-ci-cd.yaml

@@ -299,6 +299,19 @@ jobs:
           push: true
           tags: owasp/nest:backend-staging
 
+      - name: Prepare frontend public environment
+        run: |
+          touch frontend/.env
+          echo "NEXT_PUBLIC_API_URL=${{ secrets.VITE_API_URL }}" >> frontend/.env
+          echo "NEXT_PUBLIC_CSRF_URL=${{ secrets.VITE_CSRF_URL }}" >> frontend/.env
+          echo "NEXT_PUBLIC_ENVIRONMENT=${{ secrets.VITE_ENVIRONMENT }}" >> frontend/.env
+          echo "NEXT_PUBLIC_GRAPHQL_URL=${{ secrets.VITE_GRAPHQL_URL }}" >> frontend/.env
+          echo "NEXT_PUBLIC_GTM_ID=${{ secrets.NEXT_PUBLIC_GTM_ID }}" >> frontend/.env
+          echo "NEXT_PUBLIC_IDX_URL=${{ secrets.VITE_IDX_URL }}" >> frontend/.env
+          echo "NEXT_PUBLIC_IS_PROJECT_HEALTH_ENABLED=${{ secrets.NEXT_PUBLIC_IS_PROJECT_HEALTH_ENABLED }}" >> frontend/.env
+          echo "NEXT_PUBLIC_RELEASE_VERSION=${{ env.RELEASE_VERSION }}" >> frontend/.env
+          echo "NEXT_PUBLIC_SENTRY_DSN=${{ secrets.VITE_SENTRY_DSN }}" >> frontend/.env
+
       - name: Get backend image size
         id: backend-size
         run: |
@@ -431,19 +444,6 @@ jobs:
 
           # Frontend
           touch .env.frontend
-
-          # Public.
-          echo "NEXT_PUBLIC_API_URL=${{ secrets.VITE_API_URL }}" >> .env.frontend
-          echo "NEXT_PUBLIC_CSRF_URL=${{ secrets.VITE_CSRF_URL }}" >> .env.frontend
-          echo "NEXT_PUBLIC_ENVIRONMENT=${{ secrets.VITE_ENVIRONMENT }}" >> .env.frontend
-          echo "NEXT_PUBLIC_GRAPHQL_URL=${{ secrets.VITE_GRAPHQL_URL }}" >> .env.frontend
-          echo "NEXT_PUBLIC_GTM_ID=${{ secrets.NEXT_PUBLIC_GTM_ID }}" >> .env.frontend
-          echo "NEXT_PUBLIC_IDX_URL=${{ secrets.VITE_IDX_URL }}" >> .env.frontend
-          echo "NEXT_PUBLIC_IS_PROJECT_HEALTH_ENABLED=${{ secrets.NEXT_PUBLIC_IS_PROJECT_HEALTH_ENABLED }}" >> .env.frontend
-          echo "NEXT_PUBLIC_RELEASE_VERSION=${{ env.RELEASE_VERSION }}" >> .env.frontend
-          echo "NEXT_PUBLIC_SENTRY_DSN=${{ secrets.VITE_SENTRY_DSN }}" >> .env.frontend
-
-          # Private.
           echo "NEXT_SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}" >> .env.frontend
           echo "NEXT_SERVER_CSRF_URL=${{ secrets.NEXT_SERVER_CSRF_URL }}" >> .env.frontend
           echo "NEXT_SERVER_GITHUB_CLIENT_ID=${{ secrets.NEST_GITHUB_CLIENT_ID }}" >> .env.frontend
@@ -567,6 +567,19 @@ jobs:
           DISPLAY_SIZE=$(numfmt --to=iec --suffix=B "$RAW_SIZE")
           echo "human_readable=$DISPLAY_SIZE" >> $GITHUB_OUTPUT
 
+      - name: Prepare frontend public environment
+        run: |
+          touch frontend/.env
+          echo "NEXT_PUBLIC_API_URL=${{ secrets.VITE_API_URL }}" >> frontend/.env
+          echo "NEXT_PUBLIC_CSRF_URL=${{ secrets.VITE_CSRF_URL }}" >> frontend/.env
+          echo "NEXT_PUBLIC_ENVIRONMENT=${{ secrets.VITE_ENVIRONMENT }}" >> frontend/.env
+          echo "NEXT_PUBLIC_GRAPHQL_URL=${{ secrets.VITE_GRAPHQL_URL }}" >> frontend/.env
+          echo "NEXT_PUBLIC_GTM_ID=${{ secrets.NEXT_PUBLIC_GTM_ID }}" >> frontend/.env
+          echo "NEXT_PUBLIC_IDX_URL=${{ secrets.VITE_IDX_URL }}" >> frontend/.env
+          echo "NEXT_PUBLIC_IS_PROJECT_HEALTH_ENABLED=${{ secrets.NEXT_PUBLIC_IS_PROJECT_HEALTH_ENABLED }}" >> frontend/.env
+          echo "NEXT_PUBLIC_RELEASE_VERSION=${{ env.RELEASE_VERSION }}" >> frontend/.env
+          echo "NEXT_PUBLIC_SENTRY_DSN=${{ secrets.VITE_SENTRY_DSN }}" >> frontend/.env
+
       - name: Build frontend image
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
         with:
@@ -697,19 +710,6 @@ jobs:
 
           # Frontend
           touch .env.frontend
-
-          # Public.
-          echo "NEXT_PUBLIC_API_URL=${{ secrets.VITE_API_URL }}" >> .env.frontend
-          echo "NEXT_PUBLIC_CSRF_URL=${{ secrets.VITE_CSRF_URL }}" >> .env.frontend
-          echo "NEXT_PUBLIC_ENVIRONMENT=${{ secrets.VITE_ENVIRONMENT }}" >> .env.frontend
-          echo "NEXT_PUBLIC_GRAPHQL_URL=${{ secrets.VITE_GRAPHQL_URL }}" >> .env.frontend
-          echo "NEXT_PUBLIC_GTM_ID=${{ secrets.NEXT_PUBLIC_GTM_ID }}" >> .env.frontend
-          echo "NEXT_PUBLIC_IDX_URL=${{ secrets.VITE_IDX_URL }}" >> .env.frontend
-          echo "NEXT_PUBLIC_IS_PROJECT_HEALTH_ENABLED=${{ secrets.NEXT_PUBLIC_IS_PROJECT_HEALTH_ENABLED }}" >> .env.frontend
-          echo "NEXT_PUBLIC_RELEASE_VERSION=${{ env.RELEASE_VERSION }}" >> .env.frontend
-          echo "NEXT_PUBLIC_SENTRY_DSN=${{ secrets.VITE_SENTRY_DSN }}" >> .env.frontend
-
-          # Private.
           echo "NEXT_SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}" >> .env.frontend
           echo "NEXT_SERVER_CSRF_URL=${{ secrets.NEXT_SERVER_CSRF_URL }}" >> .env.frontend
           echo "NEXT_SERVER_GITHUB_CLIENT_ID=${{ secrets.NEST_GITHUB_CLIENT_ID }}" >> .env.frontend

frontend/docker/Dockerfile

@@ -27,7 +27,7 @@ COPY --chmod=444 package.json pnpm-lock.yaml ./
 RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
     pnpm install --frozen-lockfile --ignore-scripts
 
-COPY --chmod=444 .pnpmrc next.config.ts postcss.config.js tailwind.config.js tsconfig.json ./
+COPY --chmod=444 .env .pnpmrc next.config.ts postcss.config.js tailwind.config.js tsconfig.json ./
 COPY --chmod=555 public public
 COPY --chmod=555 src src
 
@@ -53,7 +53,7 @@ COPY --from=builder --chown=root:root --chmod=555 /app/public public
 COPY --from=builder --chown=root:root --chmod=555  /app/.next/standalone .
 
 # Create cache directory and assign ownership to nextjs user with write permission, so that cache can be stored.
-RUN mkdir -p /app/.next/cache && chown -R nextjs:nodejs /app/.next/cache && chmod -R 755 /app/.next/cache
+RUN mkdir -p /app/.next/cache && chown -R nextjs:nodejs /app/.next/cache && chmod -R 755 /app/.next/cache && rm .env
 COPY --from=builder --chown=root:root --chmod=555 /app/.next/static .next/static
 
 USER nextjs