Conversation
…#970) The previous "Provision runtime-env secret" step only emitted four hardcoded keys (AUTH_SECRET / COOKIE_SECRET / COOKIE_SECURE / DATABASE_URL) into the cluster Secret. Every other env the running app needs — DATA_REPOSITORY, GH_TOKEN, all DATABASE_* Neon vars, POLAR_*, STRIPE_*, TRIGGER_DEV_*, POSTHOG_*, RESEND_*, EMAIL_*, NEXT_PUBLIC_*, TENANT_ID, CRON_SECRET, etc. — was silently dropped, even when set as repo secrets, breaking content rendering and any feature that depends on them. This step now iterates toJSON(secrets) and forwards everything except a small deny-list of workflow/CI-control names (K8S_*, REGISTRY_*, DOCKERHUB_*, DIGITALOCEAN_*, GITHUB_*, the auto-injected github_token). NEXT_PUBLIC_APP_URL / COOKIE_DOMAIN are still derived from K8S_INGRESS_HOST so the cluster always serves its actual public hostname. Surfaced during the directory-web-template demo→k8s-works migration: the pod booted, but the page logged "'DATA_REPOSITORY' is not defined. Content features will be limited." until we manually patched the runtime Secret — and the next workflow run would have wiped it again. Logs the forwarded key names (never values) on each deploy for an audit trail. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Free Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Note 🎁 Summarized by CodeRabbit FreeThe PR author is not assigned a seat. To perform a comprehensive line-by-line review, please assign a seat to the pull request author through the subscription management page by visiting https://app.coderabbit.ai/login. Comment |
1 participant
Cascade of PR #970 — deploy_k8s.yaml now forwards all repo secrets (minus K8S_/REGISTRY_/DOCKERHUB_/DIGITALOCEAN_/GITHUB_) into the runtime Secret, instead of only AUTH_SECRET/COOKIE_SECRET/COOKIE_SECURE/DATABASE_URL.