From f64c95d18beccbc3b13c8493218b611b28f2a048 Mon Sep 17 00:00:00 2001
From: Marcus Messer <marcus@marcusm.co.uk>
Date: Mon, 12 Oct 2026 12:25:24 +0100
Subject: [PATCH] Split function admin API key into staging and production

Add function-admin-api-key-staging and function-admin-api-key-production
secrets for Lambda deploys, keeping function-admin-api-key as a
deprecated fallback so existing callers keep working.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/deploy.yml            | 25 +++++++++++++++++++------
 .github/workflows/production_deploy.yml |  8 ++++----
 .github/workflows/staging_deploy.yml    |  8 ++++----
 3 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 6e70f7c..03a9d9d 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -60,9 +60,15 @@ on:
       aws-secret-key:
         description: "The AWS secret access key"
         required: true
+      function-admin-api-key-staging:
+        description: "The API key for the Lambda Feedback staging backend function admin API"
+        required: false
+      function-admin-api-key-production:
+        description: "The API key for the Lambda Feedback production backend function admin API"
+        required: false
       function-admin-api-key:
-        description: "The API key for the Lambda Feedback backend function admin API"
-        required: true
+        description: "Deprecated: shared admin API key, used as a fallback when the staging/production keys are not set"
+        required: false
       build-secrets:
         description: "The Docker secrets to use for the build"
         required: false
@@ -133,10 +139,17 @@ jobs:
             echo "Error: aws-secret-key secret is required"
             exit 1
           fi
-          if [[ -z "${{ secrets.function-admin-api-key }}" ]]; then
-            echo "Error: function-admin-api-key secret is required"
+          if [[ -z "${{ secrets.function-admin-api-key-staging || secrets.function-admin-api-key }}" ]]; then
+            echo "Error: function-admin-api-key-staging secret is required"
             exit 1
           fi
+          if [[ "${{ inputs.environment }}" == "production" && -z "${{ secrets.function-admin-api-key-production || secrets.function-admin-api-key }}" ]]; then
+            echo "Error: function-admin-api-key-production secret is required when deploying to production"
+            exit 1
+          fi
+          if [[ -n "${{ secrets.function-admin-api-key }}" ]]; then
+            echo "::warning::function-admin-api-key is deprecated, pass function-admin-api-key-staging and function-admin-api-key-production instead"
+          fi
 
   deploy-staging:
     if: inputs.environment == 'staging' || inputs.environment == 'production'
@@ -155,7 +168,7 @@ jobs:
     secrets:
       aws-key-id: ${{ secrets.aws-key-id }}
       aws-secret-key: ${{ secrets.aws-secret-key }}
-      function-admin-api-key: ${{ secrets.function-admin-api-key }}
+      function-admin-api-key-staging: ${{ secrets.function-admin-api-key-staging || secrets.function-admin-api-key }}
       build-secrets: ${{ secrets.build-secrets }}
 
   await-approval:
@@ -194,5 +207,5 @@ jobs:
     secrets:
       aws-key-id: ${{ secrets.aws-key-id }}
       aws-secret-key: ${{ secrets.aws-secret-key }}
-      function-admin-api-key: ${{ secrets.function-admin-api-key }}
+      function-admin-api-key-production: ${{ secrets.function-admin-api-key-production || secrets.function-admin-api-key }}
       build-secrets: ${{ secrets.build-secrets }}
diff --git a/.github/workflows/production_deploy.yml b/.github/workflows/production_deploy.yml
index abd2654..1a5ccbb 100644
--- a/.github/workflows/production_deploy.yml
+++ b/.github/workflows/production_deploy.yml
@@ -58,9 +58,9 @@ on:
       aws-secret-key:
         description: "The AWS secret access key"
         required: true
-      function-admin-api-key:
-        description: "The API key for the Lambda Feedback backend function admin API"
-        required: true
+      function-admin-api-key-production:
+        description: "The API key for the Lambda Feedback production backend function admin API"
+        required: false
       build-secrets:
         description: "The Docker secrets to use for the build"
         required: false
@@ -242,4 +242,4 @@ jobs:
     secrets:
       aws-key-id: ${{ secrets.aws-key-id }}
       aws-secret-key: ${{ secrets.aws-secret-key }}
-      function-admin-api-key: ${{ secrets.function-admin-api-key }}
+      function-admin-api-key: ${{ secrets.function-admin-api-key-production }}
diff --git a/.github/workflows/staging_deploy.yml b/.github/workflows/staging_deploy.yml
index 98094a1..c10c2d0 100644
--- a/.github/workflows/staging_deploy.yml
+++ b/.github/workflows/staging_deploy.yml
@@ -49,9 +49,9 @@ on:
       aws-secret-key:
         description: "The AWS secret access key"
         required: true
-      function-admin-api-key:
-        description: "The API key for the Lambda Feedback backend function admin API"
-        required: true
+      function-admin-api-key-staging:
+        description: "The API key for the Lambda Feedback staging backend function admin API"
+        required: false
       build-secrets:
         description: "The Docker secrets to use for the build"
         required: false
@@ -91,4 +91,4 @@ jobs:
     secrets:
       aws-key-id: ${{ secrets.aws-key-id }}
       aws-secret-key: ${{ secrets.aws-secret-key }}
-      function-admin-api-key: ${{ secrets.function-admin-api-key }}
+      function-admin-api-key: ${{ secrets.function-admin-api-key-staging }}