support env var for gh url, dont duplicate webhook secret (#2381)

Author: motatoes

helm-charts/README.md

@@ -17,7 +17,7 @@ kubectl create namespace opentaco
 kubectl create secret generic ui-secrets \
   --from-env-file=.secrets/ui.env -n opentaco
 
-kubectl create secret generic backend-secrets \
+kubectl create secret generic taco-orchestrator-secrets \
   --from-env-file=.secrets/digger-backend.env -n opentaco
 
 kubectl create secret generic statesman-secrets \

ui/src/components/AddConnectionDialog.tsx

@@ -12,9 +12,10 @@ import { GithubConnectButton } from "./GithubConnectButton"
 interface AddConnectionDialogProps {
   onBitbucketSubmit: (data: { type: string; bitbucket_webhook_secret: string; bitbucket_access_token: string }) => Promise<void>
   onGitlabSubmit: (data: { type: string; gitlab_webhook_secret: string, gitlab_access_token: string }) => Promise<void>
+  githubAppUrl: string
 }
 
-export function AddConnectionDialog({ onBitbucketSubmit, onGitlabSubmit }: AddConnectionDialogProps) {
+export function AddConnectionDialog({ onBitbucketSubmit, onGitlabSubmit, githubAppUrl  }: AddConnectionDialogProps) {
   const [connectionType, setConnectionType] = useState("")
   const [webhookSecret, setWebhookSecret] = useState("")
   const [bitbucketAccessToken, setBitbucketAccessToken] = useState("")
@@ -37,7 +38,7 @@ export function AddConnectionDialog({ onBitbucketSubmit, onGitlabSubmit }: AddCo
   }
 
   const handleGitHubConnect = async () => {
-    window.location.href = "https://github.com/apps/digger-pro";
+    window.location.href = githubAppUrl;
   };
 
   return (
@@ -64,7 +65,7 @@ export function AddConnectionDialog({ onBitbucketSubmit, onGitlabSubmit }: AddCo
 
         {connectionType === "github" && (
           <div className="mt-4 space-y-4">
-            <p>To connect your GitHub repository, you need to install our <a href="https://github.com/apps/digger-pro" target="_blank" rel="noopener noreferrer">GitHub App</a>.</p>
+            <p>To connect your GitHub repository, you need to install our <a href={githubAppUrl} target="_blank" rel="noopener noreferrer">GitHub App</a>.</p>
             <GithubConnectButton source="add_connection_dialog" onClick={handleGitHubConnect} />
           </div>
         )}

ui/src/components/GitHubConnection.tsx

@@ -1,11 +1,11 @@
 import { Button } from "@/components/ui/button"
 
-export default function GitHubConnection() {
+export default function GitHubConnection({ githubAppUrl }: { githubAppUrl: string }) {
   return (
     <div className="space-y-4">
       <p>To connect your GitHub repository, you need to install our GitHub App.</p>
       <Button asChild>
-        <a href="https://github.com/apps/digger-pro" target="_blank" rel="noopener noreferrer">
+        <a href={githubAppUrl} target="_blank" rel="noopener noreferrer">
           Install GitHub App
         </a>
       </Button>

ui/src/components/OnboardingSteps.tsx

@@ -33,6 +33,7 @@ interface OnboardingStepsProps {
   email: string
   organisationId: string
   publicHostname: string
+  githubAppUrl: string
 }
 
 interface WorkflowConfig {
@@ -42,7 +43,7 @@ interface WorkflowConfig {
   iacVersion: string
 }
 
-export default function OnboardingSteps({ repoName, repoOwner, onComplete, userId, email, organisationId, publicHostname }: OnboardingStepsProps) {
+export default function OnboardingSteps({ repoName, repoOwner, onComplete, userId, email, organisationId, publicHostname , githubAppUrl}: OnboardingStepsProps) {
   const [currentStep, setCurrentStep] = useState(() => {
     if (typeof window !== 'undefined') {
       const step = new URLSearchParams(window.location.search).get('step')
@@ -183,7 +184,7 @@ jobs:
 
 
   const handleGithubConnect = () => {
-    window.open("https://github.com/apps/digger-pro", "_blank")
+    window.open(githubAppUrl, "_blank")
     setCurrentStep("workflow")
     setSteps(prev => ({ ...prev, githubConnected: true }))
   }

ui/src/lib/env.server.ts

@@ -10,6 +10,7 @@ export type Env = {
   PUBLIC_HOSTNAME: string
   STATESMAN_BACKEND_URL: string
   WORKOS_REDIRECT_URI: string
+  ORCHESTRATOR_GITHUB_APP_URL: string
 }
 
 export const getPublicServerConfig = createServerFn({ method: 'GET' })
@@ -19,5 +20,6 @@ export const getPublicServerConfig = createServerFn({ method: 'GET' })
       PUBLIC_HOSTNAME: process.env.PUBLIC_URL?.replace('https://', '').replace('http://', '') ?? '',
       STATESMAN_BACKEND_URL: process.env.STATESMAN_BACKEND_URL ?? '',
       WORKOS_REDIRECT_URI: process.env.WORKOS_REDIRECT_URI ?? '',
+      ORCHESTRATOR_GITHUB_APP_URL: process.env.ORCHESTRATOR_GITHUB_APP_URL ?? '',
     } as Env
 })

ui/src/routes/_authenticated/_dashboard/dashboard/onboarding.tsx

@@ -17,12 +17,13 @@ export const Route = createFileRoute(
   loader: async ({ context }) => {
     const { user, organisationId, publicServerConfig } = context
     const publicHostname = publicServerConfig?.PUBLIC_HOSTNAME || ''
-    return { user, organisationId, publicHostname }
+    const githubAppUrl = publicServerConfig?.ORCHESTRATOR_GITHUB_APP_URL || ''
+    return { user, organisationId, publicHostname, githubAppUrl  }
   },
 })
 
 function RouteComponent() {
-    const { user, organisationId, publicHostname } = Route.useLoaderData()
+    const { user, organisationId, publicHostname, githubAppUrl } = Route.useLoaderData()
     const [repoInfo, setRepoInfo] = useState<RepoInfo | null>(null)
     const router = useRouter()
     const handleOnboardingComplete = () => {
@@ -46,6 +47,7 @@ function RouteComponent() {
         email={user?.email || ''}
         organisationId={organisationId || ''}
         publicHostname={publicHostname}
+        githubAppUrl={githubAppUrl}
         onComplete={handleOnboardingComplete}
       />
     ) : (
@@ -54,6 +56,7 @@ function RouteComponent() {
         email={user?.email || ''}
         organisationId={organisationId || ''}
         publicHostname={publicHostname}
+        githubAppUrl={githubAppUrl}
         onComplete={handleOnboardingComplete}
       />
     )}

ui/src/routes/tfe/$.tsx

@@ -48,6 +48,7 @@ async function handler({ request }) {
   if (!token) {
     return new Response('Unauthorized: No token provided', { status: 401 })
   }
+
 
   // Verify token against TOKEN SERVICE and extract user context
   let userId, userEmail, orgId;
@@ -108,9 +109,9 @@ async function handler({ request }) {
   }
 
   // Use webhook auth to forward to internal TFE routes
-  const webhookSecret = process.env.OPENTACO_ENABLE_INTERNAL_ENDPOINTS;
+  const webhookSecret = process.env.STATESMAN_BACKEND_WEBHOOK_SECRET;
   if (!webhookSecret) {
-    console.error('OPENTACO_ENABLE_INTERNAL_ENDPOINTS not configured');
+    console.error('STATESMAN_BACKEND_WEBHOOK_SECRET not configured');
     return new Response('Internal configuration error', { status: 500 });
   }