feat: add env var support to App Platform driver

Create/Update now map env_vars and secret_env_vars from spec config to
godo AppVariableDefinition. SECRET type is used for sensitive values so
DigitalOcean stores them encrypted. Tests cover env var passthrough for
both Create and Update paths.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: intel352

internal/drivers/app_platform.go

@@ -52,6 +52,7 @@ func (d *AppPlatformDriver) Create(ctx context.Context, spec interfaces.Resource
 					Name:          spec.Name,
 					InstanceCount: int64(instanceCount),
 					HTTPPort:      int64(httpPort),
+					Envs:          envVarsFromConfig(spec.Config),
 					Image: &godo.ImageSourceSpec{
 						RegistryType: godo.ImageSourceSpecRegistryType_DOCR,
 						Repository:   imageRepo(image),
@@ -95,6 +96,7 @@ func (d *AppPlatformDriver) Update(ctx context.Context, ref interfaces.ResourceR
 					Name:          spec.Name,
 					InstanceCount: int64(instanceCount),
 					HTTPPort:      int64(httpPort),
+					Envs:          envVarsFromConfig(spec.Config),
 					Image: &godo.ImageSourceSpec{
 						RegistryType: godo.ImageSourceSpecRegistryType_DOCR,
 						Repository:   imageRepo(image),
@@ -191,3 +193,32 @@ func imageTag(image string) string {
 	}
 	return "latest"
 }
+
+// envVarsFromConfig converts the "env_vars" map in spec config to App Platform
+// environment variable definitions. Values listed under "secret_env_vars" are
+// marked as SECRET so DigitalOcean stores them encrypted.
+func envVarsFromConfig(cfg map[string]any) []*godo.AppVariableDefinition {
+	raw, _ := cfg["env_vars"].(map[string]any)
+	secrets, _ := cfg["secret_env_vars"].(map[string]any)
+	if len(raw) == 0 && len(secrets) == 0 {
+		return nil
+	}
+	envs := make([]*godo.AppVariableDefinition, 0, len(raw)+len(secrets))
+	for k, v := range raw {
+		envs = append(envs, &godo.AppVariableDefinition{
+			Key:   k,
+			Value: fmt.Sprintf("%v", v),
+			Type:  godo.AppVariableType_General,
+			Scope: godo.AppVariableScope_RunAndBuildTime,
+		})
+	}
+	for k, v := range secrets {
+		envs = append(envs, &godo.AppVariableDefinition{
+			Key:   k,
+			Value: fmt.Sprintf("%v", v),
+			Type:  godo.AppVariableType_Secret,
+			Scope: godo.AppVariableScope_RunAndBuildTime,
+		})
+	}
+	return envs
+}

internal/drivers/app_platform_test.go

@@ -12,17 +12,21 @@ import (
 
 // mockAppClient is a mock implementation of AppPlatformClient.
 type mockAppClient struct {
-	app *godo.App
-	err error
+	app           *godo.App
+	err           error
+	lastCreateReq *godo.AppCreateRequest
+	lastUpdateReq *godo.AppUpdateRequest
 }
 
-func (m *mockAppClient) Create(_ context.Context, _ *godo.AppCreateRequest) (*godo.App, *godo.Response, error) {
+func (m *mockAppClient) Create(_ context.Context, req *godo.AppCreateRequest) (*godo.App, *godo.Response, error) {
+	m.lastCreateReq = req
 	return m.app, nil, m.err
 }
 func (m *mockAppClient) Get(_ context.Context, _ string) (*godo.App, *godo.Response, error) {
 	return m.app, nil, m.err
 }
-func (m *mockAppClient) Update(_ context.Context, _ string, _ *godo.AppUpdateRequest) (*godo.App, *godo.Response, error) {
+func (m *mockAppClient) Update(_ context.Context, _ string, req *godo.AppUpdateRequest) (*godo.App, *godo.Response, error) {
+	m.lastUpdateReq = req
 	return m.app, nil, m.err
 }
 func (m *mockAppClient) Delete(_ context.Context, _ string) (*godo.Response, error) {
@@ -217,6 +221,93 @@ func TestAppPlatformDriver_Diff_NoChanges(t *testing.T) {
 	}
 }
 
+func TestAppPlatformDriver_Create_EnvVars(t *testing.T) {
+	mock := &mockAppClient{app: testApp()}
+	d := drivers.NewAppPlatformDriverWithClient(mock, "nyc3")
+
+	_, err := d.Create(context.Background(), interfaces.ResourceSpec{
+		Name: "my-app",
+		Config: map[string]any{
+			"image": "registry.digitalocean.com/myrepo/myapp:v1",
+			"env_vars": map[string]any{
+				"SESSION_STORE": "pg",
+				"GRPC_PORT":     "8080",
+			},
+			"secret_env_vars": map[string]any{
+				"DATABASE_URL": "postgres://user:pass@host/db",
+				"JWT_SECRET":   "s3cr3t",
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if mock.lastCreateReq == nil {
+		t.Fatal("no create request captured")
+	}
+	svc := mock.lastCreateReq.Spec.Services[0]
+	if len(svc.Envs) != 4 {
+		t.Fatalf("expected 4 env vars, got %d", len(svc.Envs))
+	}
+	envMap := make(map[string]*godo.AppVariableDefinition, len(svc.Envs))
+	for _, e := range svc.Envs {
+		envMap[e.Key] = e
+	}
+	if envMap["SESSION_STORE"] == nil || envMap["SESSION_STORE"].Value != "pg" {
+		t.Errorf("SESSION_STORE not set correctly")
+	}
+	if envMap["DATABASE_URL"] == nil || envMap["DATABASE_URL"].Type != godo.AppVariableType_Secret {
+		t.Errorf("DATABASE_URL not marked as secret")
+	}
+}
+
+func TestAppPlatformDriver_Update_EnvVars(t *testing.T) {
+	mock := &mockAppClient{app: testApp()}
+	d := drivers.NewAppPlatformDriverWithClient(mock, "nyc3")
+
+	_, err := d.Update(context.Background(), interfaces.ResourceRef{
+		Name: "my-app", ProviderID: "app-123",
+	}, interfaces.ResourceSpec{
+		Name: "my-app",
+		Config: map[string]any{
+			"image": "registry.digitalocean.com/myrepo/myapp:v2",
+			"env_vars": map[string]any{
+				"HEALTH_PORT": "8080",
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+	if mock.lastUpdateReq == nil {
+		t.Fatal("no update request captured")
+	}
+	svc := mock.lastUpdateReq.Spec.Services[0]
+	if len(svc.Envs) != 1 {
+		t.Fatalf("expected 1 env var, got %d", len(svc.Envs))
+	}
+	if svc.Envs[0].Key != "HEALTH_PORT" || svc.Envs[0].Value != "8080" {
+		t.Errorf("HEALTH_PORT env var not set correctly")
+	}
+}
+
+func TestAppPlatformDriver_Create_NoEnvVars(t *testing.T) {
+	mock := &mockAppClient{app: testApp()}
+	d := drivers.NewAppPlatformDriverWithClient(mock, "nyc3")
+
+	_, err := d.Create(context.Background(), interfaces.ResourceSpec{
+		Name:   "my-app",
+		Config: map[string]any{"image": "registry.digitalocean.com/myrepo/myapp:v1"},
+	})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	svc := mock.lastCreateReq.Spec.Services[0]
+	if len(svc.Envs) != 0 {
+		t.Errorf("expected no env vars when not specified, got %d", len(svc.Envs))
+	}
+}
+
 func TestAppPlatformDriver_HealthCheck_Unhealthy(t *testing.T) {
 	app := &godo.App{
 		ID:   "app-123",