From 4a871f9cfd7908180f35463e506ad84c064d8765 Mon Sep 17 00:00:00 2001
From: Barden <barden2410@gmail.com>
Date: Sun, 22 Feb 2026 15:11:16 +0300
Subject: [PATCH 1/2] Security patch

---
 .github/workflows/first_pipeline.yml | 32 ++++++++++++++++++++--------
 1 file changed, 23 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/first_pipeline.yml b/.github/workflows/first_pipeline.yml
index ebd0d14..a82c82e 100644
--- a/.github/workflows/first_pipeline.yml
+++ b/.github/workflows/first_pipeline.yml
@@ -56,21 +56,31 @@ jobs:
   deploy_job:
     needs: build_job
     runs-on: self-hosted
+    environment: Production
     if: github.ref == 'refs/heads/master'
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Create .env file
+        env:
+          POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
+          POSTGRES_DB: ${{ secrets.POSTGRES_DB }}
+          DATABASE_URL: ${{ secrets.DATABASE_URL }}
+          REDIS_PASSWORD: ${{ secrets.REDIS_PASSWORD }}
+          REDIS_DB: ${{ secrets.REDIS_DB }}
+          REDIS_URL: ${{ secrets.REDIS_URL }}
+
         run: |
-          echo "POSTGRES_USER=${{ secrets.POSTGRES_USER }}" >> .env
-          echo "POSTGRES_PASSWORD=${{ secrets.POSTGRES_PASSWORD }}" >> .env
-          echo "POSTGRES_DB=${{ secrets.POSTGRES_DB }}" >> .env
-          echo "DATABASE_URL=${{ secrets.DATABASE_URL }}" >> .env
-          
-          echo "REDIS_PASSWORD=${{ secrets.REDIS_PASSWORD }}" >> .env
-          echo "REDIS_DB=${{ secrets.REDIS_DB }}" >> .env
-          echo "REDIS_URL=${{ secrets.REDIS_URL }}" >> .env
+          touch .env
+          echo "POSTGRES_USER=$POSTGRES_USER" >> .env
+          echo "POSTGRES_PASSWORD=$POSTGRES_PASSWORD" >> .env
+          echo "POSTGRES_DB=$POSTGRES_DB" >> .env
+          echo "DATABASE_URL=$DATABASE_URL" >> .env
+          echo "REDIS_PASSWORD=$REDIS_PASSWORD" >> .env
+          echo "REDIS_DB=$REDIS_DB" >> .env
+          echo "REDIS_URL=$REDIS_URL" >> .env
 
       - name: Stops all containers
         run: docker compose down
@@ -82,4 +92,8 @@ jobs:
         run: sleep 10
 
       - name: Update alembic head
-        run: docker compose exec web alembic upgrade head
\ No newline at end of file
+        run: docker compose exec web alembic upgrade head
+
+      - name: Cleanup workspace
+        if: always()
+        run: rm -rf .env
\ No newline at end of file

From 7d363a104fdb2f249b04595ad5d23afaf97dc864 Mon Sep 17 00:00:00 2001
From: Barden <barden2410@gmail.com>
Date: Sun, 22 Feb 2026 15:13:19 +0300
Subject: [PATCH 2/2] Security patch

---
 .github/workflows/first_pipeline.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/first_pipeline.yml b/.github/workflows/first_pipeline.yml
index a82c82e..d6f9f6a 100644
--- a/.github/workflows/first_pipeline.yml
+++ b/.github/workflows/first_pipeline.yml
@@ -41,13 +41,13 @@ jobs:
           echo "TEST_DATABASE_URL=postgresql+asyncpg://test_user:test_password@localhost:5432/test_db" >> .env.test
           echo "TEST_REDIS_URL=redis://localhost:6379/0" >> .env.test
 
-      - name: Check prod with linters
+      - name: Check production with linters
         run: |
           isort --check .
           black --check .
           flake8 .
 
-      - name: Check prod with pytest
+      - name: Check production with pytest
         env:
           DATABASE_URL: "postgresql+asyncpg://test_user:test_password@localhost:5432/test_db"
           REDIS_URL: "redis://:test_password@localhost:6379/1"