fix(ci): isolate staging Actions settings under STG prefix

Map staging Secrets and Variables exclusively from STG names, validate explicit API and SSO settings, and pass them to the staging Worker. Preserve production settings and document the variable registration and Secret migration.

Validation: source checks and 113 tests pass. Gitea STG Variables were created and verified; Secret registration remains with the user.

scripts/deploy-worker.mjs

@@ -1,8 +1,9 @@
 import { spawn } from 'node:child_process';
-import { deploymentOrgSettings } from './org-context-settings.mjs';
+import { stagingSettings } from './staging-settings.mjs';
 
 const worker = 'baron-qa-gateway-test';
 const dryRun = process.argv.includes('--dry-run');
+const validateOnly = process.argv.includes('--validate-only');
 function execute(args, input) {
   return new Promise((resolve, reject) => {
     const child = spawn('npx', ['wrangler', ...args], {
@@ -26,13 +27,16 @@ function execute(args, input) {
   });
 }
 try {
-  const { vars, secrets } = deploymentOrgSettings(process.env);
-  if (!dryRun && Object.keys(secrets).length) await execute(['secret', 'bulk', '--name', worker], JSON.stringify(secrets));
-  const args = ['deploy', '--name', worker];
-  if (dryRun) args.push('--dry-run');
-  for (const [name, value] of Object.entries(vars)) args.push('--var', name + ':' + value);
-  await execute(args);
-} catch {
-  console.error('Worker deployment failed. Check configuration and preceding Wrangler diagnostics.');
+  if (process.argv.slice(2).some((option) => !['--dry-run', '--validate-only'].includes(option))) throw new Error('Unknown staging deployment option');
+  const { vars, secrets } = stagingSettings(process.env);
+  if (!validateOnly) {
+    if (!dryRun && Object.keys(secrets).length) await execute(['secret', 'bulk', '--name', worker], JSON.stringify(secrets));
+    const args = ['deploy', '--config', 'wrangler.toml', '--name', worker];
+    if (dryRun) args.push('--dry-run');
+    for (const [name, value] of Object.entries(vars)) args.push('--var', name + ':' + value);
+    await execute(args);
+  }
+} catch (error) {
+  console.error(error.message || 'Worker deployment failed. Check configuration and preceding Wrangler diagnostics.');
   process.exitCode = 1;
 }

scripts/staging-settings.mjs

@@ -0,0 +1,36 @@
+import { deploymentOrgSettings } from './org-context-settings.mjs';
+
+function required(env, name) {
+  const value = String(env[name] || '').trim();
+  if (!value) throw new Error('STG_' + name + ' is required for staging');
+  return value;
+}
+
+function httpsUrl(value, name, originOnly = false) {
+  let url;
+  try { url = new URL(value); } catch { throw new Error('STG_' + name + ' must be an HTTPS URL'); }
+  if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash || (originOnly && url.pathname !== '/')) {
+    throw new Error('STG_' + name + ' must be an HTTPS ' + (originOnly ? 'origin' : 'issuer URL'));
+  }
+  return originOnly ? url.origin : url.origin + url.pathname.replace(/\/+$/, '');
+}
+
+export function stagingSettings(env) {
+  const organization = deploymentOrgSettings({ ...env, ORG_CONTEXT_ENABLED: required(env, 'ORG_CONTEXT_ENABLED') });
+  const issuer = httpsUrl(required(env, 'AUTH_ISSUER'), 'AUTH_ISSUER');
+  const vars = {
+    ...organization.vars,
+    AUTH_CLIENT_ID: required(env, 'AUTH_CLIENT_ID'),
+    AUTH_AUTHORIZE_URL: issuer + '/oauth2/auth',
+    AUTH_TOKEN_URL: issuer + '/oauth2/token',
+    AUTH_USERINFO_URL: issuer + '/userinfo',
+    ABC_API_BASE_URL: httpsUrl(required(env, 'ABC_API_BASE_URL'), 'ABC_API_BASE_URL', true),
+    ABC_PROJECT_ID: required(env, 'ABC_PROJECT_ID'),
+    ABC_CHANNEL_ID: required(env, 'ABC_CHANNEL_ID')
+  };
+  const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  for (const name of ['ABC_PROJECT_ID', 'ABC_CHANNEL_ID']) {
+    if (!uuid.test(vars[name])) throw new Error('STG_' + name + ' must be a UUID');
+  }
+  return { vars, secrets: organization.secrets };
+}