Add containerized staging deployment

scripts/sync-staging-credentials.mjs

@@ -0,0 +1,46 @@
+import { spawnSync } from 'node:child_process';
+import { readFile, writeFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import process from 'node:process';
+
+const stagingFile = resolve('.env.staging');
+const dotenvxCli = resolve('node_modules/@dotenvx/dotenvx/src/cli/dotenvx.js');
+const sharedKeys = [
+	'DISCORD_CLIENT_ID',
+	'DISCORD_CLIENT_SECRET',
+	'SMTP_HOST',
+	'SMTP_PORT',
+	'SMTP_SECURE',
+	'SMTP_USER',
+	'SMTP_PASSWORD',
+	'SMTP_FROM'
+];
+
+for (const key of sharedKeys) {
+	if (!process.env[key]) throw new Error(`Source environment is missing ${key}.`);
+}
+
+function dotenvx(action) {
+	const result = spawnSync(process.execPath, [dotenvxCli, action, '-f', stagingFile], {
+		cwd: process.cwd(),
+		stdio: 'inherit'
+	});
+	if (result.error) throw result.error;
+	if (result.status !== 0) throw new Error(`dotenvx ${action} failed.`);
+}
+
+dotenvx('decrypt');
+try {
+	let contents = await readFile(stagingFile, 'utf8');
+	for (const key of sharedKeys) {
+		const replacement = `${key}=${JSON.stringify(process.env[key])}`;
+		const pattern = new RegExp(`^${key}=.*$`, 'm');
+		if (!pattern.test(contents)) throw new Error(`Staging environment is missing ${key}.`);
+		contents = contents.replace(pattern, replacement);
+	}
+	await writeFile(stagingFile, contents, 'utf8');
+} finally {
+	dotenvx('encrypt');
+}
+
+console.log('Copied shared Discord and SMTP credentials into encrypted staging configuration.');