From 9cf84cb70d6d68ba6444888187c7756b59ee1bfb Mon Sep 17 00:00:00 2001
From: suguanYang <wangbinqi77@gmail.com>
Date: Mon, 13 Jul 2026 16:56:51 +0800
Subject: [PATCH 1/2] fix: use optional newsletter database secret ref

---
 .github/workflows/deploy.yml | 46 +++++++++++++++++++++++++++---------
 README.md                    |  2 +-
 2 files changed, 36 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 9142ce3..bef2829 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -30,8 +30,6 @@ env:
   DASHBOARD_AUTH_COOKIE_DOMAIN_STAGING: staging.knowhereto.ai
   DASHBOARD_AUTH_ALLOWED_CALLBACK_ORIGINS_PROD: https://notebook.knowhereto.ai
   DASHBOARD_AUTH_ALLOWED_CALLBACK_ORIGINS_STAGING: https://notebook.staging.knowhereto.ai
-  DASHBOARD_NEWSLETTER_DATABASE_URL_PROD: ${{ secrets.NEWSLETTER_DATABASE_URL }}
-  DASHBOARD_NEWSLETTER_DATABASE_URL_STAGING: ${{ secrets.NEWSLETTER_DATABASE_URL_STAGING }}
   DASHBOARD_POSTHOG_HOST: https://us.i.posthog.com
 
 jobs:
@@ -73,14 +71,12 @@ jobs:
             api_url="${DASHBOARD_API_URL_PROD}"
             auth_cookie_domain="${DASHBOARD_AUTH_COOKIE_DOMAIN_PROD}"
             auth_allowed_callback_origins="${DASHBOARD_AUTH_ALLOWED_CALLBACK_ORIGINS_PROD}"
-            newsletter_database_url="${DASHBOARD_NEWSLETTER_DATABASE_URL_PROD}"
           else
             kube_namespace="${DASHBOARD_KUBE_NAMESPACE_STAGING}"
             app_url="${DASHBOARD_APP_URL_STAGING}"
             api_url="${DASHBOARD_API_URL_STAGING}"
             auth_cookie_domain="${DASHBOARD_AUTH_COOKIE_DOMAIN_STAGING}"
             auth_allowed_callback_origins="${DASHBOARD_AUTH_ALLOWED_CALLBACK_ORIGINS_STAGING}"
-            newsletter_database_url="${DASHBOARD_NEWSLETTER_DATABASE_URL_STAGING}"
           fi
           auth_base_url="${DASHBOARD_AUTH_BASE_URL}"
 
@@ -103,10 +99,6 @@ jobs:
               missing+=("$variable_name")
             fi
           done
-          if [ "$environment" = "prod" ] && [ -z "${newsletter_database_url}" ]; then
-            missing+=("NEWSLETTER_DATABASE_URL")
-          fi
-
           if [ "${#missing[@]}" -gt 0 ]; then
             printf 'Missing deployment configuration: %s\n' "${missing[*]}" >&2
             exit 1
@@ -268,7 +260,6 @@ jobs:
           echo "DEPLOY_AUTH_COOKIE_DOMAIN=${auth_cookie_domain}" >> "$GITHUB_ENV"
           echo "DEPLOY_AUTH_ALLOWED_CALLBACK_ORIGINS=${auth_allowed_callback_origins}" >> "$GITHUB_ENV"
           echo "DEPLOY_AUTH_BASE_URL=${auth_base_url}" >> "$GITHUB_ENV"
-          echo "DEPLOY_NEWSLETTER_DATABASE_URL=${newsletter_database_url}" >> "$GITHUB_ENV"
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -287,7 +278,7 @@ jobs:
             --name "${AWS_EKS_PROD_CLUSTER_NAME}" \
             --region "${AWS_EKS_PROD_REGION}"
 
-      - name: Roll out dashboard
+      - name: Configure deployment environment
         shell: bash
         run: |
           kubectl set env "deployment/${DEPLOY_KUBE_DEPLOYMENT}" \
@@ -296,9 +287,42 @@ jobs:
             "AUTH_COOKIE_DOMAIN=${DEPLOY_AUTH_COOKIE_DOMAIN}" \
             "NEXT_PUBLIC_AUTH_ALLOWED_CALLBACK_ORIGINS=${DEPLOY_AUTH_ALLOWED_CALLBACK_ORIGINS}" \
             "NEXT_PUBLIC_APP_URL=${DEPLOY_APP_URL}" \
-            "NEWSLETTER_DATABASE_URL=${DEPLOY_NEWSLETTER_DATABASE_URL}" \
             --namespace "${DEPLOY_KUBE_NAMESPACE}"
 
+      - name: Attach optional newsletter database secret
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          kubectl set env "deployment/${DEPLOY_KUBE_DEPLOYMENT}" \
+            NEWSLETTER_DATABASE_URL- \
+            --namespace "${DEPLOY_KUBE_NAMESPACE}"
+
+          newsletter_secret_patch="$(
+            cat <<PATCH
+spec:
+  template:
+    spec:
+      containers:
+        - name: ${DEPLOY_KUBE_CONTAINER}
+          env:
+            - name: NEWSLETTER_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: knowhere-secrets
+                  key: newsletter-database-url
+                  optional: true
+PATCH
+          )"
+
+          kubectl patch "deployment/${DEPLOY_KUBE_DEPLOYMENT}" \
+            --namespace "${DEPLOY_KUBE_NAMESPACE}" \
+            --type=strategic \
+            --patch "${newsletter_secret_patch}"
+
+      - name: Roll out dashboard image
+        shell: bash
+        run: |
           kubectl set image "deployment/${DEPLOY_KUBE_DEPLOYMENT}" \
             "${DEPLOY_KUBE_CONTAINER}=${DEPLOY_IMAGE_URI}" \
             --namespace "${DEPLOY_KUBE_NAMESPACE}"
diff --git a/README.md b/README.md
index fbcb0ae..fb32a6d 100644
--- a/README.md
+++ b/README.md
@@ -104,7 +104,7 @@ pnpm db:migrate
 pnpm newsletter-db:migrate
 ```
 
-Production newsletter storage requires the GitHub Actions secret `NEWSLETTER_DATABASE_URL`. If it is unset outside production, newsletter storage falls back to `DATABASE_URL`.
+Production newsletter storage reads `NEWSLETTER_DATABASE_URL` from the optional Kubernetes Secret key `knowhere-secrets/newsletter-database-url` when it exists. If it is unset, newsletter storage falls back to `DATABASE_URL`.
 
 ## Docker
 

From 814567406ad0c1b93d9af7beb0cab7dde1f68192 Mon Sep 17 00:00:00 2001
From: suguanYang <wangbinqi77@gmail.com>
Date: Mon, 13 Jul 2026 17:33:01 +0800
Subject: [PATCH 2/2] fix: indent newsletter secret patch heredoc

---
 .github/workflows/deploy.yml | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index bef2829..bc25645 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -300,19 +300,19 @@ jobs:
 
           newsletter_secret_patch="$(
             cat <<PATCH
-spec:
-  template:
-    spec:
-      containers:
-        - name: ${DEPLOY_KUBE_CONTAINER}
-          env:
-            - name: NEWSLETTER_DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: knowhere-secrets
-                  key: newsletter-database-url
-                  optional: true
-PATCH
+          spec:
+            template:
+              spec:
+                containers:
+                  - name: ${DEPLOY_KUBE_CONTAINER}
+                    env:
+                      - name: NEWSLETTER_DATABASE_URL
+                        valueFrom:
+                          secretKeyRef:
+                            name: knowhere-secrets
+                            key: newsletter-database-url
+                            optional: true
+          PATCH
           )"
 
           kubectl patch "deployment/${DEPLOY_KUBE_DEPLOYMENT}" \