Strip CR from env before TEE deploy

SethGammon · claude · SethGammon · commit caf7d572dc8e · 2026-06-16T17:32:55.000-04:00
The eigenx TEE wrapper sources the deployed env before the app starts; a
stray CR in a secret value breaks that source step and the app exits
(Failed) regardless of image/method/flags — which matches every code
deploy failure. Strip \r when writing app.env; ENV_CODE also re-set from
the verified-clean local .env.deploy.

Co-Authored-By: Claude Opus 4.8 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/.github/workflows/deploy-eigencompute.yml b/.github/workflows/deploy-eigencompute.yml
@@ -76,7 +76,11 @@ jobs:
           DEPLOY_IMAGE_REF: ${{ inputs.image }}-eigenx
         run: |
           trap 'rm -f app.env' EXIT
-          printf '%s' "$APP_ENV_FILE" > app.env
+          # Strip CR: a stray \r\n in the env secret survives into the values,
+          # and the eigenx TEE wrapper sources the env before the app starts —
+          # a CR in a value breaks that source step and the app exits (Failed),
+          # regardless of image. tr -d '\r' guarantees clean LF-only values.
+          printf '%s' "$APP_ENV_FILE" | tr -d '\r' > app.env
           while IFS='=' read -r name value; do
             case "$name" in ''|\#*) continue ;; esac
             if [ -n "$value" ]; then
