From d7fbe88eb83536a68348e9e2f341995a216eeb3f Mon Sep 17 00:00:00 2001
From: Prad Nukala <prad@sonr.io>
Date: Wed, 30 Sep 2026 15:31:31 -0400
Subject: [PATCH] ci(ci): add OpenRouter API key secret to deploy workflow

---
 .github/workflows/deploy.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index cea53f5..d3e3448 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -54,8 +54,9 @@ jobs:
 
   # Deploys on every main push (not path-filtered): apps/api/data/schedule.json
   # is bundled at deploy time, and re-deploying an unchanged Worker is a no-op.
-  # Needs repo secrets CLOUDFLARE_API_TOKEN (Workers Scripts: Edit) and
-  # CLOUDFLARE_ACCOUNT_ID.
+  # Needs repo secrets CLOUDFLARE_API_TOKEN (Workers Scripts: Edit),
+  # CLOUDFLARE_ACCOUNT_ID, and OPENROUTER_API_KEY (the docs assistant's
+  # POST /ask; the Actions secret is the one copy, mirrored into the Worker).
   deploy-api:
     runs-on: ubuntu-latest
     steps:
@@ -68,6 +69,13 @@ jobs:
       # DST cron guards must hold before the Worker ships.
       - run: bun run api:test
 
+      - run: printf %s "$OPENROUTER_API_KEY" | bunx wrangler secret put OPENROUTER_API_KEY
+        working-directory: apps/api
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+
       - run: bun run api:deploy
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}