fix: prepare secrets from pinned La Suite Docs base

runner/harness/abra.py

@@ -126,6 +126,25 @@ def recipe_checkout(recipe: str, version: str) -> None:
     subprocess.run(["git", "-C", path, "checkout", "-f", "--quiet", version], check=True)
 
 
+def ensure_secret_versions_from_recipe(recipe: str, domain: str) -> None:
+    """Fill missing secret versions after a pinned checkout.
+
+    `app new <recipe> <version>` creates its .env from whichever recipe tree was
+    checked out *before* it pins the version. A removed secret in the current
+    recipe can therefore be missing from the older base's .env. Keep existing
+    assignments, including versions intentionally changed by install hooks.
+    """
+    sample = os.path.join(recipe_dir(recipe), ".env.sample")
+    if not os.path.isfile(sample):
+        return
+    pattern = re.compile(r"^\s*(SECRET_[A-Z0-9_]+_VERSION)=(v[A-Za-z0-9._-]+)")
+    with open(sample) as fh:
+        for line in fh:
+            match = pattern.match(line)
+            if match and env_get(domain, match.group(1)) is None:
+                env_set(domain, match.group(1), match.group(2))
+
+
 def has_lightweight_version_tags(recipe: str) -> bool:
     """True if the recipe's local checkout has any LIGHTWEIGHT (non-annotated) version tag.
 

runner/harness/lifecycle.py

@@ -444,6 +444,7 @@ def deploy_app(
         )
     elif version:
         abra.recipe_checkout(recipe, version)
+        abra.ensure_secret_versions_from_recipe(recipe, domain)
         # A pinned (non-chaos) deploy runs `abra recipe lint`, which FATAs R014 ('only annotated
         # tags') if the upstream recipe ships a stray lightweight version tag (e.g. lasuite-meet's
         # 0.3.0+v1.16.0). In that case deploy the EXPLICITLY-checked-out pinned version with chaos: