Added env file support

deploy/action.yml

@@ -16,6 +16,13 @@ inputs:
     required: false
     default: ""
     description: Extra docker build args (space-separated KEY=VALUE pairs)
+  env-vars:
+    required: false
+    default: ""
+    description: |
+      Runtime env vars for the container, one KEY=VALUE per line.
+      Merged on top of /opt/apps/${app-name}/.env.${environment} on the runner;
+      keys defined here win. Use secrets to avoid leaking values into logs.
 
 runs:
   using: composite
@@ -66,6 +73,19 @@ runs:
           -t ${{ inputs.app-name }}:${{ steps.derive.outputs.tag }} \
           -f dockerfile .
 
+    - name: Write workflow env-vars to file
+      id: env-file
+      shell: bash
+      env:
+        ENV_VARS: ${{ inputs.env-vars }}
+      run: |
+        OVERRIDE_FILE=""
+        if [[ -n "$ENV_VARS" ]]; then
+          OVERRIDE_FILE=$(mktemp)
+          printf '%s\n' "$ENV_VARS" > "$OVERRIDE_FILE"
+        fi
+        echo "path=$OVERRIDE_FILE" >> "$GITHUB_OUTPUT"
+
     - name: Deploy container
       shell: bash
       run: |
@@ -74,7 +94,8 @@ runs:
           --tag "${{ steps.derive.outputs.tag }}" \
           --port "${{ steps.derive.outputs.port }}" \
           --internal-port "${{ inputs.internal-port }}" \
-          --env "${{ steps.derive.outputs.environment }}"
+          --env "${{ steps.derive.outputs.environment }}" \
+          --env-override "${{ steps.env-file.outputs.path }}"
 
     - name: Register Pangolin resource
       shell: bash