Add compose environment secrets handling to CI workflow

.github/workflows/tests.yml

@@ -74,6 +74,23 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Materialize compose env files
+        env:
+          COMPOSE_ENV: ${{ secrets.COMPOSE_ENV }}
+          COMPOSE_ENV_STAGING: ${{ secrets.COMPOSE_ENV_STAGING }}
+        run: |
+          set -euo pipefail
+          if [ -z "${COMPOSE_ENV}" ]; then
+            echo "Required GitHub secret COMPOSE_ENV is not configured." >&2
+            exit 1
+          fi
+          if [ -z "${COMPOSE_ENV_STAGING}" ]; then
+            echo "Required GitHub secret COMPOSE_ENV_STAGING is not configured." >&2
+            exit 1
+          fi
+          printf '%s\n' "$COMPOSE_ENV" > .env
+          printf '%s\n' "$COMPOSE_ENV_STAGING" > .env.staging
+
       - name: Validate compose contracts
         run: |
           docker compose -f docker-compose.yml -f docker-compose.prod.yml config > /dev/null