fix(env): validate Docker-compatible variable keys

Add shared environment variable key validation and normalization for Livewire forms and models, allowing Docker-compatible keys while rejecting invalid entries such as keys containing equals signs. Also quote Railpack build environment and secret arguments safely.

tests/Unit/ApplicationDeploymentRailpackConfigTest.php

@@ -225,14 +225,14 @@ it('builds railpack docker command with matching env and secret flags for all ra
         ],
     );
 
-    expect($command)->toContain("env RAILPACK_NODE_VERSION='22'");
-    expect($command)->toContain("RAILPACK_INSTALL_CMD='npm ci && npm run postinstall'");
-    expect($command)->toContain("RAILPACK_DEPLOY_APT_PACKAGES='curl wget'");
-    expect($command)->toContain("SECRET_JSON='{\"token\":\"abc\"}'");
-    expect($command)->toContain('--secret id=RAILPACK_NODE_VERSION,env=RAILPACK_NODE_VERSION');
-    expect($command)->toContain('--secret id=RAILPACK_INSTALL_CMD,env=RAILPACK_INSTALL_CMD');
-    expect($command)->toContain('--secret id=RAILPACK_DEPLOY_APT_PACKAGES,env=RAILPACK_DEPLOY_APT_PACKAGES');
-    expect($command)->toContain('--secret id=SECRET_JSON,env=SECRET_JSON');
+    expect($command)->toContain("env 'RAILPACK_NODE_VERSION=22'");
+    expect($command)->toContain("'RAILPACK_INSTALL_CMD=npm ci && npm run postinstall'");
+    expect($command)->toContain("'RAILPACK_DEPLOY_APT_PACKAGES=curl wget'");
+    expect($command)->toContain("'SECRET_JSON={\"token\":\"abc\"}'");
+    expect($command)->toContain("--secret 'id=RAILPACK_NODE_VERSION,env=RAILPACK_NODE_VERSION'");
+    expect($command)->toContain("--secret 'id=RAILPACK_INSTALL_CMD,env=RAILPACK_INSTALL_CMD'");
+    expect($command)->toContain("--secret 'id=RAILPACK_DEPLOY_APT_PACKAGES,env=RAILPACK_DEPLOY_APT_PACKAGES'");
+    expect($command)->toContain("--secret 'id=SECRET_JSON,env=SECRET_JSON'");
     expect($command)->toContain(' --build-arg secrets-hash=');
     expect($command)->toContain('--build-arg BUILDKIT_SYNTAX="ghcr.io/railwayapp/railpack-frontend:v'.config('constants.coolify.railpack_version').'"');
 });

tests/Unit/EnvironmentVariableBuildpackControlTest.php

@@ -1,6 +1,7 @@
 <?php
 
 use App\Models\EnvironmentVariable;
+use App\Models\SharedEnvironmentVariable;
 
 it('flags NIXPACKS_ keys as buildpack control variables', function () {
     $env = new EnvironmentVariable;
@@ -35,3 +36,39 @@ it('lists is_buildpack_control in appends and drops legacy is_nixpacks', functio
     expect($env->getAppends())->toContain('is_buildpack_control');
     expect($env->getAppends())->not->toContain('is_nixpacks');
 });
+
+it('normalizes environment variable keys before storing them on the model', function () {
+    $env = new EnvironmentVariable;
+    $env->key = ' node.name ';
+
+    expect($env->key)->toBe('node.name');
+});
+
+it('allows Docker-compatible environment variable keys on the model', function (string $key) {
+    $env = new EnvironmentVariable;
+    $env->key = $key;
+
+    expect($env->key)->toBe($key);
+})->with([
+    'starts with digit' => '1BAD',
+    'hyphen' => 'BAD-KEY',
+    'dot' => 'node.name',
+    'uppercase dots' => 'XPACK.SECURITY.ENABLED',
+    'semicolon' => 'BAD;KEY',
+]);
+
+it('rejects environment variable keys Docker cannot represent on the model', function () {
+    $env = new EnvironmentVariable;
+
+    expect(function () use ($env) {
+        $env->key = 'BAD=KEY';
+    })->toThrow(InvalidArgumentException::class, 'Docker-compatible');
+});
+
+it('rejects shared environment variable keys Docker cannot represent on the model', function () {
+    $env = new SharedEnvironmentVariable;
+
+    expect(function () use ($env) {
+        $env->key = 'BAD=KEY';
+    })->toThrow(InvalidArgumentException::class, 'Docker-compatible');
+});

tests/Unit/ValidationPatternsTest.php

@@ -130,3 +130,38 @@ it('generates nullable dockerNetworkRules when not required', function () {
     expect($rules)->toContain('nullable')
         ->not->toContain('required');
 });
+
+it('accepts Docker-compatible environment variable keys', function (string $key) {
+    expect(ValidationPatterns::isValidEnvironmentVariableKey($key))->toBeTrue();
+})->with([
+    'letters' => 'APP_ENV',
+    'leading underscore' => '_TOKEN',
+    'railpack control variable' => 'RAILPACK_NODE_VERSION',
+    'digits after first character' => 'NODE_VERSION_20',
+    'starts with digit' => '1BAD',
+    'hyphen' => 'BAD-KEY',
+    'dot' => 'node.name',
+    'uppercase dots' => 'XPACK.SECURITY.ENABLED',
+    'semicolon' => 'BAD;KEY',
+    'space' => 'BAD KEY',
+]);
+
+it('rejects environment variable keys Docker cannot represent', function (string $key) {
+    expect(ValidationPatterns::isValidEnvironmentVariableKey($key))->toBeFalse();
+})->with([
+    'equals' => 'BAD=KEY',
+    'empty' => '',
+]);
+
+it('generates environment variable key rules with correct defaults', function () {
+    $rules = ValidationPatterns::environmentVariableKeyRules();
+
+    expect($rules)->toContain('required')
+        ->toContain('string')
+        ->toContain('max:255')
+        ->toContain('regex:'.ValidationPatterns::ENVIRONMENT_VARIABLE_KEY_PATTERN);
+});
+
+it('normalizes environment variable keys by trimming surrounding whitespace', function () {
+    expect(ValidationPatterns::normalizeEnvironmentVariableKey(' node.name '))->toBe('node.name');
+});