test(cli): pin deploy init scaffold env.secret round-trip (#3158) (#3204)

#3008 added a $rejectEnvSecrets guard that hard-failed any non-empty
env.secret with Wheels.Deploy.EnvSecretUnsupported, which made the
env.secret block scaffolded by `wheels deploy init` (WHEELS_RELOAD_PASSWORD)
un-deployable without manual editing. #3167 then retired that guard and
implemented env.secret delivery via a remote --env-file (600 perms, SFTP),
so the scaffolded block is now correct and deploys end-to-end.

This pins that contract with two DeployMainCliSpec regression tests:

- the init scaffold round-trips through config() and deploy --dry-run with
  no EnvSecretUnsupported/EnvSecretMissing, and the dry-run routes the
  secret through the --env-file path;
- a deploy of the scaffold delivers WHEELS_RELOAD_PASSWORD to the role env
  file over SFTP (FakeSshPool uploadString), never in argv.

Both tests fail if the scaffold drops its env.secret block (verified by
temporarily removing it), so they guard the scaffold and the deploy engine
against drifting apart again. No template or engine change is needed: the
scaffold is correct as shipped now that env.secret is a delivered feature.

CLI suite (lucee7 docker harness): 1071 pass / 0 fail / 2 tolerated
docker-env artifacts (SshClientSpec/SshPoolSpec require docker-in-docker).

Refs #3008, #3167
Fixes #3158

Signed-off-by: Peter Amiri <petera@pai.com>
Co-authored-by: Peter Amiri <petera@pai.com>

Author: bpamiri

changelog.d/3158-deploy-init-envsecret-roundtrip.fixed.md

@@ -0,0 +1 @@
+- `wheels deploy init` scaffolds an `env.secret: [WHEELS_RELOAD_PASSWORD]` block that now round-trips cleanly: with env-file delivery in place (#2957), a freshly-scaffolded config passes `wheels deploy config` and `wheels deploy deploy --dry-run` and ships the secret to containers via the remote `--env-file`, instead of hard-failing with the retired `Wheels.Deploy.EnvSecretUnsupported` guard. The scaffold and the deploy engine are now pinned together by a regression spec (#3158)

cli/lucli/tests/specs/deploy/cli/DeployMainCliSpec.cfc

@@ -349,6 +349,94 @@ component extends="wheels.wheelstest.system.BaseSpec" {
                 expect(fileExists(root & "templates/deploy/init/dockerignore.mustache")).toBeTrue();
             });
 
+            // #3158 — the `wheels deploy init` scaffold must round-trip through
+            // `config` and `deploy --dry-run` without the EnvSecretUnsupported
+            // hard-fail #3008 introduced. Since #3167 retired that guard and
+            // delivers env.secret via a remote env file, the scaffolded
+            // `env.secret: [WHEELS_RELOAD_PASSWORD]` block is now correct and
+            // must validate + deploy end-to-end. These pin that contract so the
+            // scaffold and the deploy engine can never drift back apart.
+            it("the init scaffold round-trips through config() and deploy --dry-run with no EnvSecret error (##3158)", () => {
+                var tmpCwd = getTempDirectory() & "/wheels-3158-init-roundtrip-" & createUUID();
+                directoryCreate(tmpCwd, true, true);
+                try {
+                    var localCli = new cli.lucli.services.deploy.cli.DeployMainCli(
+                        new cli.lucli.services.deploy.lib.FakeSshPool(),
+                        {projectRoot: tmpCwd}
+                    );
+                    localCli.init_stub({cwd: tmpCwd, service: "demo", image: "acme/demo"});
+
+                    var cfgPath = tmpCwd & "/config/deploy.yml";
+                    // The scaffold declares env.secret: [WHEELS_RELOAD_PASSWORD]
+                    // and .kamal/secrets declares the matching (empty) key, so
+                    // the resolver supplies a value and env_file_content() does
+                    // not raise EnvSecretMissing.
+                    expect(fileRead(cfgPath)).toInclude("WHEELS_RELOAD_PASSWORD");
+                    expect(fileRead(tmpCwd & "/.kamal/secrets")).toInclude("WHEELS_RELOAD_PASSWORD");
+
+                    // config() must validate and dump the scaffold unchanged.
+                    var configOut = localCli.config({configPath: cfgPath});
+                    expect(configOut).toInclude("service: demo");
+
+                    // deploy --dry-run must not throw EnvSecretUnsupported/Missing
+                    // and must route the secret through the --env-file path.
+                    var fake2 = new cli.lucli.services.deploy.lib.FakeSshPool();
+                    var dc = new cli.lucli.services.deploy.cli.DeployMainCli(
+                        fake2,
+                        {projectRoot: tmpCwd}
+                    );
+                    var dryOut = dc.deploy({configPath: cfgPath, version: "v1", dryRun: true});
+                    expect(arrayLen(fake2.calls())).toBe(0);
+                    expect(dryOut).toInclude("--env-file .kamal/apps/demo/env/roles/web.env");
+                    expect(dryOut).toInclude("WHEELS_RELOAD_PASSWORD");
+                } finally {
+                    directoryDelete(tmpCwd, true);
+                }
+            });
+
+            it("a deploy of the init scaffold delivers WHEELS_RELOAD_PASSWORD via the env file, never argv (##3158)", () => {
+                var tmpCwd = getTempDirectory() & "/wheels-3158-init-deliver-" & createUUID();
+                directoryCreate(tmpCwd, true, true);
+                try {
+                    var localCli = new cli.lucli.services.deploy.cli.DeployMainCli(
+                        new cli.lucli.services.deploy.lib.FakeSshPool(),
+                        {projectRoot: tmpCwd}
+                    );
+                    localCli.init_stub({cwd: tmpCwd, service: "demo", image: "acme/demo"});
+
+                    // A user populates the scaffolded secrets file; the registry
+                    // password the scaffold also references is set so the deploy
+                    // path resolves cleanly.
+                    fileWrite(
+                        tmpCwd & "/.kamal/secrets",
+                        "KAMAL_REGISTRY_PASSWORD=regpw#chr(10)#WHEELS_RELOAD_PASSWORD=reload-s3cret"
+                    );
+
+                    var fake = new cli.lucli.services.deploy.lib.FakeSshPool();
+                    var dc = new cli.lucli.services.deploy.cli.DeployMainCli(
+                        fake,
+                        {projectRoot: tmpCwd}
+                    );
+                    dc.deploy({configPath: tmpCwd & "/config/deploy.yml", version: "v1"});
+
+                    var calls = fake.calls();
+                    var uploadIdx = 0;
+                    for (var i = 1; i <= arrayLen(calls); i++) {
+                        if (!uploadIdx && (calls[i].kind ?: "") == "uploadString") uploadIdx = i;
+                    }
+                    expect(uploadIdx).toBeGT(0);
+                    // The scaffolded secret reaches the role env file over SFTP.
+                    expect(calls[uploadIdx].remote).toBe(".kamal/apps/demo/env/roles/web.env");
+                    expect(calls[uploadIdx].content).toInclude("WHEELS_RELOAD_PASSWORD=reload-s3cret");
+                    // The value must never appear in any command string.
+                    for (var c in calls) {
+                        expect(c.cmd ?: "").notToInclude("reload-s3cret");
+                    }
+                } finally {
+                    directoryDelete(tmpCwd, true);
+                }
+            });
+
             it("audit dispatches tail of audit log to every host", () => {
                 var fake = new cli.lucli.services.deploy.lib.FakeSshPool();
                 var dc = new cli.lucli.services.deploy.cli.DeployMainCli(fake);