ci: add PROD_QWEN_OAUTH_CREDS to deploy workflow and script

Author: ilyar

.github/workflows/deploy.yml

@@ -40,11 +40,13 @@ jobs:
         shell: bash
         env:
           PROD_VPS_PASSWORD: ${{ secrets.PROD_VPS_PASSWORD }}
+          PROD_QWEN_OAUTH_CREDS: ${{ secrets.PROD_QWEN_OAUTH_CREDS }}
           PROD_TELEGRAM_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_BOT_TOKEN }}
         run: |
           missing=()
           for name in \
             PROD_VPS_PASSWORD \
+            PROD_QWEN_OAUTH_CREDS \
             PROD_TELEGRAM_BOT_TOKEN
           do
             if [[ -z "${!name}" ]]; then
@@ -66,8 +68,10 @@ jobs:
       - name: Deploy production stack
         env:
           PROD_VPS_PASSWORD: ${{ secrets.PROD_VPS_PASSWORD }}
+          PROD_QWEN_OAUTH_CREDS: ${{ secrets.PROD_QWEN_OAUTH_CREDS }}
           PROD_TELEGRAM_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_BOT_TOKEN }}
         run: |
           bash ./scripts/deploy-prod.sh \
             "$PROD_VPS_PASSWORD" \
+            "$PROD_QWEN_OAUTH_CREDS" \
             "$PROD_TELEGRAM_BOT_TOKEN"

scripts/deploy-prod.sh

@@ -1,16 +1,17 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-if [[ $# -lt 2 ]]; then
-  echo "Usage: $0 <ssh-password> <telegram-bot-token> [ssh-host] [ssh-user] [public-origin]" >&2
+if [[ $# -lt 3 ]]; then
+  echo "Usage: $0 <ssh-password> <qwen-oauth-creds-b64> <telegram-bot-token> [ssh-host] [ssh-user] [public-origin]" >&2
   exit 1
 fi
 
 SSH_PASSWORD="$1"
-TELEGRAM_BOT_TOKEN="$2"
-SSH_HOST="${3-spawn-dock.w3voice.net}"
-SSH_USER="${4:-ops}"
-PUBLIC_ORIGIN="${5:-https://spawn-dock.w3voice.net}"
+QWEN_OAUTH_CREDS_B64="$2"
+TELEGRAM_BOT_TOKEN="$3"
+SSH_HOST="${4-spawn-dock.w3voice.net}"
+SSH_USER="${5:-ops}"
+PUBLIC_ORIGIN="${6:-https://spawn-dock.w3voice.net}"
 TARGET_DIR="/srv/spawndock-api"
 BOT_SECRET="$(openssl rand -hex 24)"
 BOT_CONTROL_PLANE_URL="http://mcp-server:3000"
@@ -68,6 +69,7 @@ QWEN_CODE_COMMAND=qwen
 QWEN_CODE_AUTH_TYPE=qwen-oauth
 QWEN_CONTAINER_IMAGE=spawndock/qwen-search:prod
 QWEN_KNOWLEDGE_HOST_PATH=${TARGET_DIR}/knowledge
+QWEN_OAUTH_CREDS_B64=${QWEN_OAUTH_CREDS_B64}
 HF_TOKEN=
 EOF