feat(build): add CS_N_PATH to override custom service build context

[acamarata]

Summary

• Adds a BuildPath field to CustomService (config/types.go) and parses a new CS_N_PATH env var per custom service slot
• Rejects absolute paths and .. traversal at parse time (security validation)
• Updates buildCustomService in compose/custom_services.go to use BuildPath when set, falling back to the default ./services/{name}
• Adds 3 new test cases covering valid override, absolute-path rejection, and traversal rejection

Motivation

web/backend reorganized ping_api into backend/services/ping_api/ but the compose generator kept hardcoding ./services/{name}. The deployed prod container was building from an untracked legacy copy at ./services/ping_api/ that lacked billing, Stripe, license, dunning and CRM modules. CS_N_PATH lets web/backend set CS_1_PATH=./backend/services/ping_api in .env.* and have nself build generate the correct context path.

Test plan

• go test -mod=vendor ./internal/config/... -run TestCustomServices — all 6 tests pass
• nself build with CS_1_PATH=./backend/services/ping_api generates compose with correct build.context
• CS_1_PATH=/etc/secrets is rejected at parse time with clear error
• CS_1_PATH=../../outside is rejected at parse time with clear error
• Unset CS_1_PATH still defaults to ./services/ping_api (no regression)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cli	Ready	Preview, Comment	May 13, 2026 6:55pm