fix(docker): source GitHub OAuth creds from GH_OAUTH_* (GITHUB_ prefix is reserved) (#1327)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: FelixTJDietrich

docker/.env.example

@@ -37,8 +37,10 @@ HEPHAESTUS_AUTH_STATE_COOKIE_KEY=
 
 # GitHub OAuth App (https://github.com/settings/developers).
 # Callback: https://<hostname>/api/login/oauth2/code/github
-GITHUB_OAUTH_CLIENT_ID=
-GITHUB_OAUTH_CLIENT_SECRET=
+# Named GH_OAUTH_* (not GITHUB_OAUTH_*) because GitHub Actions reserves the GITHUB_ prefix for
+# secret/variable names; compose maps these onto the GITHUB_OAUTH_* the server actually reads.
+GH_OAUTH_CLIENT_ID=
+GH_OAUTH_CLIENT_SECRET=
 
 # GitLab OAuth application (gitlab.com or self-hosted; scope: read_user — OAuth2 flow, not OIDC).
 # Callback: https://<hostname>/api/login/oauth2/code/gitlab. Leave the client id blank to disable.

docker/compose.app.yaml

@@ -117,8 +117,10 @@ services:
       # <provider>:<subject>. Optional break-glass token enables POST /auth/bootstrap-admin.
       HEPHAESTUS_AUTH_BOOTSTRAP_ADMINS: ${HEPHAESTUS_AUTH_BOOTSTRAP_ADMINS:-}
       HEPHAESTUS_AUTH_BOOTSTRAP_TOKEN: ${HEPHAESTUS_AUTH_BOOTSTRAP_TOKEN:-}
-      GITHUB_OAUTH_CLIENT_ID: ${GITHUB_OAUTH_CLIENT_ID}
-      GITHUB_OAUTH_CLIENT_SECRET: ${GITHUB_OAUTH_CLIENT_SECRET}
+      # Sourced from GH_OAUTH_* — GitHub Actions reserves the GITHUB_ prefix for secret/variable
+      # names, so the deploy can't provide GITHUB_OAUTH_*; the container still presents it to Spring.
+      GITHUB_OAUTH_CLIENT_ID: ${GH_OAUTH_CLIENT_ID:-}
+      GITHUB_OAUTH_CLIENT_SECRET: ${GH_OAUTH_CLIENT_SECRET:-}
       GITLAB_OAUTH_CLIENT_ID: ${GITLAB_OAUTH_CLIENT_ID:-}
       GITLAB_OAUTH_CLIENT_SECRET: ${GITLAB_OAUTH_CLIENT_SECRET:-}
       GITLAB_OAUTH_BASE_URL: ${GITLAB_OAUTH_BASE_URL:-https://gitlab.com}

docker/preview/compose.app.yaml

@@ -208,8 +208,9 @@ services:
       # Public URL for issuer validation (must match token's iss claim).
       HEPHAESTUS_AUTH_ISSUER: https://${PREVIEW_DOMAIN:?Required}
       HEPHAESTUS_AUTH_STATE_COOKIE_KEY: ${HEPHAESTUS_AUTH_STATE_COOKIE_KEY:?Required}
-      GITHUB_OAUTH_CLIENT_ID: ${GITHUB_OAUTH_CLIENT_ID}
-      GITHUB_OAUTH_CLIENT_SECRET: ${GITHUB_OAUTH_CLIENT_SECRET}
+      # Sourced from GH_OAUTH_* — GitHub Actions reserves the GITHUB_ prefix for secret/variable names.
+      GITHUB_OAUTH_CLIENT_ID: ${GH_OAUTH_CLIENT_ID:-}
+      GITHUB_OAUTH_CLIENT_SECRET: ${GH_OAUTH_CLIENT_SECRET:-}
       GITLAB_OAUTH_CLIENT_ID: ${GITLAB_OAUTH_CLIENT_ID:-}
       GITLAB_OAUTH_CLIENT_SECRET: ${GITLAB_OAUTH_CLIENT_SECRET:-}
       GITLAB_OAUTH_BASE_URL: ${GITLAB_OAUTH_BASE_URL:-https://gitlab.com}