fix: isolate production migration database URL

scripts/src/gitops-render/runtime-manifests.mjs

@@ -737,7 +737,15 @@ function externalPostgresConfigForLane(deploy, profile, args = {}) {
   assert.ok(typeof effective.endpointAddress === "string" && effective.endpointAddress.length > 0, `deploy.lanes.${profile}.externalPostgres.endpointAddress is required`);
   const port = Number(effective.port ?? 5432);
   assert.ok(Number.isInteger(port) && port > 0 && port <= 65535, `deploy.lanes.${profile}.externalPostgres.port must be a valid TCP port`);
-  return { serviceName: effective.serviceName, endpointAddress: effective.endpointAddress, port };
+  const migrationSecretName = effective.migrationSecretName;
+  const migrationSecretKey = effective.migrationSecretKey;
+  assert.equal(typeof migrationSecretName === "string", typeof migrationSecretKey === "string", `deploy.lanes.${profile}.externalPostgres migration Secret name and key must be declared together`);
+  return {
+    serviceName: effective.serviceName,
+    endpointAddress: effective.endpointAddress,
+    port,
+    ...(typeof migrationSecretName === "string" ? { migrationSecretName, migrationSecretKey } : {})
+  };
 }
 
 function externalPostgresManifest({ profile = "v03", config, source, deploy = null, migrationSources = [], catalog = null, registryPrefix = defaultRegistryPrefix, useDeployImages = false }) {
@@ -816,7 +824,12 @@ function externalPostgresManifest({ profile = "v03", config, source, deploy = nu
                 command: ["node", "/opt/hwlab-migrations/run.mjs"],
                 env: [{
                   name: "DATABASE_URL",
-                  valueFrom: { secretKeyRef: { name: `hwlab-cloud-api-${profile}-db`, key: "database-url" } }
+                  valueFrom: {
+                    secretKeyRef: {
+                      name: config.migrationSecretName ?? `hwlab-cloud-api-${profile}-db`,
+                      key: config.migrationSecretKey ?? "database-url"
+                    }
+                  }
                 }],
                 volumeMounts: [{ name: "migrations", mountPath: "/opt/hwlab-migrations", readOnly: true }]
               }],