fix(platform-infra): transfer nginx API key as binary secret

scripts/src/platform-infra-nginx.ts

@@ -1,5 +1,14 @@
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, statSync } from "node:fs";
+import {
+  chmodSync,
+  existsSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
 import { isAbsolute, join } from "node:path";
 import type { UniDeskConfig } from "./config";
 import { repoRoot, rootPath } from "./config";
@@ -293,7 +302,7 @@ async function apply(config: UniDeskConfig, options: OpsApplyOptions): Promise<R
   const distributedImage = `${distribution.workDir}/${fileName(nginx.artifacts.image.remotePath)}`;
   const distributedPlugin = `${distribution.workDir}/${fileName(nginx.artifacts.composePlugin.remotePath)}`;
   const uploads = [
-    uploadArtifact(target.route, secret.sourcePath, target.runtime.envPath),
+    uploadSecret(target.route, secret.sourcePath, target.runtime.envPath),
   ];
   const failedUpload = uploads.find((upload) => !upload.ok);
   if (failedUpload !== undefined) {
@@ -675,6 +684,19 @@ function uploadArtifact(route: string, localPath: string, remotePath: string): R
   };
 }
 
+function uploadSecret(route: string, sourcePath: string, remotePath: string): Record<string, unknown> {
+  const directory = mkdtempSync(join(tmpdir(), "unidesk-nginx-secret-"));
+  const transferPath = join(directory, "runtime.bin");
+  try {
+    writeFileSync(transferPath, readFileSync(sourcePath));
+    chmodSync(transferPath, 0o600);
+    const result = uploadArtifact(route, transferPath, remotePath);
+    return { ...result, localPath: "binary-secret-transfer", valuesPrinted: false };
+  } finally {
+    rmSync(directory, { recursive: true, force: true });
+  }
+}
+
 function targetSummary(id: string, target: NginxTarget): Record<string, unknown> {
   return {
     id,