From 8495d40473446a3d9711ce11cc34acc6ea96c98a Mon Sep 17 00:00:00 2001
From: Adam Hall <adam.hall@aligent.com.au>
Date: Mon, 6 Jul 2026 12:50:07 +0930
Subject: [PATCH 1/2] Allow the passthrough of EXTRA_VARS and EXTRA_SECRETS to
 the GITHUB_ENV so we can pass arbitrary env vars to our cdk stacks that are
 needed at synth / deploy time

---
 .github/workflows/aws-cdk.yml | 16 ++++++++++++++++
 docs/aws-cdk.md               |  6 ++++++
 2 files changed, 22 insertions(+)

diff --git a/.github/workflows/aws-cdk.yml b/.github/workflows/aws-cdk.yml
index be31310..9aaba2c 100644
--- a/.github/workflows/aws-cdk.yml
+++ b/.github/workflows/aws-cdk.yml
@@ -226,6 +226,22 @@ jobs:
               ;;
           esac
 
+      - name: Export extra environment variables
+        env:
+          EXTRA_VARS: ${{ vars.EXTRA_VARS }}
+          EXTRA_SECRETS: ${{ secrets.EXTRA_SECRETS }}
+        run: |
+          if [ -n "$EXTRA_VARS" ]; then
+            while IFS= read -r line; do
+              [ -n "$line" ] && echo "$line" | tr -d '\r' >> "$GITHUB_ENV"
+            done <<< "$EXTRA_VARS"
+          fi
+          if [ -n "$EXTRA_SECRETS" ]; then
+            while IFS= read -r line; do
+              [ -n "$line" ] && echo "$line" | tr -d '\r' >> "$GITHUB_ENV"
+            done <<< "$EXTRA_SECRETS"
+          fi
+
       - name: Set CDK commands
         id: parse-cdk-config
         env:
diff --git a/docs/aws-cdk.md b/docs/aws-cdk.md
index 6ce197e..7b1ad6e 100644
--- a/docs/aws-cdk.md
+++ b/docs/aws-cdk.md
@@ -55,6 +55,12 @@ These should be configured in your GitHub Environment (or at the repository leve
 
 > **Authentication:** Configure either static credentials (`AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY`) **or** OIDC (`AWS_ROLE_ARN`). The workflow auto-detects which method to use.
 
+**Extras** — optional:
+
+| Name | Type | Description |
+|------|------|-------------|
+| `EXTRA_VARS` | Variable | Additional non-secret environment variables to inject into the deploy step |
+| `EXTRA_SECRETS` | Secret | Additional secret environment variables to inject into the deploy step |
 
 #### **Outputs**
 | Name | Description |

From fbf0e32f33370ec2a33637c435db61a005405289 Mon Sep 17 00:00:00 2001
From: Adam Hall <adam.hall@aligent.com.au>
Date: Mon, 6 Jul 2026 13:39:02 +0930
Subject: [PATCH 2/2] Add note about the format of EXTRA_VARS / SECRETS

---
 docs/aws-cdk.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/aws-cdk.md b/docs/aws-cdk.md
index 7b1ad6e..2cfd288 100644
--- a/docs/aws-cdk.md
+++ b/docs/aws-cdk.md
@@ -62,6 +62,8 @@ These should be configured in your GitHub Environment (or at the repository leve
 | `EXTRA_VARS` | Variable | Additional non-secret environment variables to inject into the deploy step |
 | `EXTRA_SECRETS` | Secret | Additional secret environment variables to inject into the deploy step |
 
+Both extra fields accept multiline `KEY=VALUE` pairs — one per line. Use these for runtime configuration that varies per project, such as feature flags.
+
 #### **Outputs**
 | Name | Description |
 |------|-------------|