fix(deploy): pass build-time secrets and fix standalone path resolution

.gitea/workflows/deploy.yml

@@ -316,6 +316,8 @@ jobs:
             S3_BUCKET=${{ secrets.S3_BUCKET || vars.S3_BUCKET || 'mintel' }}
             S3_REGION=${{ secrets.S3_REGION || vars.S3_REGION || 'fsn1' }}
             S3_PREFIX=${{ secrets.S3_PREFIX || vars.S3_PREFIX || 'mintel.me' }}
+            DATABASE_URI=${{ secrets.DATABASE_URI || (needs.prepare.outputs.target == 'testing' && secrets.TESTING_DIRECTUS_DB_PASSWORD && format('postgres://directus:{0}@postgres-db:5432/directus', secrets.TESTING_DIRECTUS_DB_PASSWORD)) || 'postgres://payload:payload@postgres-db:5432/payload' }}
+            PAYLOAD_SECRET=${{ secrets.PAYLOAD_SECRET || 'secret' }}
             BUILD_ID=${{ github.sha }}
           tags: registry.infra.mintel.me/mintel/mintel.me:${{ needs.prepare.outputs.image_tag }}
           cache-from: type=registry,ref=registry.infra.mintel.me/mintel/mintel.me:buildcache-${{ needs.prepare.outputs.target }}

Dockerfile

@@ -13,6 +13,8 @@ ARG S3_SECRET_KEY
 ARG S3_BUCKET
 ARG S3_REGION
 ARG S3_PREFIX
+ARG DATABASE_URI
+ARG PAYLOAD_SECRET
 ARG BUILD_ID
 
 # Environment variables for Next.js build
@@ -25,6 +27,8 @@ ENV S3_SECRET_KEY=$S3_SECRET_KEY
 ENV S3_BUCKET=$S3_BUCKET
 ENV S3_REGION=$S3_REGION
 ENV S3_PREFIX=$S3_PREFIX
+ENV DATABASE_URI=$DATABASE_URI
+ENV PAYLOAD_SECRET=$PAYLOAD_SECRET
 ENV SKIP_RUNTIME_ENV_VALIDATION=true
 ENV CI=true
 
@@ -78,5 +82,6 @@ RUN chown -R 1001:65533 /app
 USER nextjs
 
 # Start from the app directory to ensure references solve correctly
-WORKDIR /app/apps/web
-CMD ["node", "server.js"]
+# In Standalone mode, Next.js expects node_modules and public relative to the server.js
+WORKDIR /app
+CMD ["node", "apps/web/server.js"]