From cc8ddba7aa4fafc294edd29706c3a2ded80b748a Mon Sep 17 00:00:00 2001
From: Codex Bot <codex-bot@gitea.entroia.local>
Date: Thu, 5 Nov 2026 01:44:44 +0800
Subject: [PATCH] Accept formatted Foundry project configuration from Actions

---
 deploy/release.sh | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/deploy/release.sh b/deploy/release.sh
index a610ee4..14260ae 100644
--- a/deploy/release.sh
+++ b/deploy/release.sh
@@ -8,13 +8,36 @@ origin=https://api.foundry.entroia.com
 candidate=foundry-core-candidate
 network=endoleap-dev_default
 
-for name in GOOGLE_CLIENT_ID GOOGLE_CLIENT_SECRET FOUNDRY_PROJECTS; do
+for name in GOOGLE_CLIENT_ID GOOGLE_CLIENT_SECRET; do
   value=${!name-}
   if [[ -z "$value" || "$value" == *$'\n'* || "$value" == *$'\r'* ]]; then
     printf 'Missing or invalid %s\n' "$name" >&2
     exit 1
   fi
 done
+# Accept formatted JSON from Actions Variables and never print its contents.
+FOUNDRY_PROJECTS=$(python3 - <<'PYCONFIG'
+import json
+import os
+import sys
+
+raw = os.environ.get("FOUNDRY_PROJECTS", "")
+if not raw.strip():
+    sys.exit("FOUNDRY_PROJECTS was not injected from Actions Variables")
+try:
+    projects = json.loads(raw)
+except ValueError:
+    sys.exit("FOUNDRY_PROJECTS must be valid JSON")
+if not isinstance(projects, dict) or not projects or any(
+    not isinstance(callback, str) or not callback.strip()
+    for callback in projects.values()
+):
+    sys.exit("FOUNDRY_PROJECTS must map project names to callback URLs")
+print(json.dumps(projects, separators=(",", ":")))
+PYCONFIG
+)
+export FOUNDRY_PROJECTS
+
 test -s "$foundry/database.env"
 docker network inspect "$network" >/dev/null