fix(ci): supply RAG_QUERY_HASH_SECRET placeholder for deployment boot smoke#424
fix(ci): supply RAG_QUERY_HASH_SECRET placeholder for deployment boot smoke#424BigSimmo wants to merge 2 commits into
Conversation
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: be3ecfe235
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| RAG_QUERY_HASH_SECRET: | ||
| process.env.RAG_QUERY_HASH_SECRET ?? "placeholder-ci-rag-query-hash-secret", |
There was a problem hiding this comment.
When the main/release Deployment boot smoke job runs without a RAG_QUERY_HASH_SECRET secret, this fallback makes next start boot with a fixed placeholder instead of failing. That masks the exact production-mandatory secret enforced by instrumentation.register()/requireQueryHashSecret() and contradicts the workflow's missing-secret guard, so CI can pass while the real deployment is still missing the secret needed to avoid weak query hashes. Add RAG_QUERY_HASH_SECRET to the required smoke env and pass the real secret rather than substituting it here.
Useful? React with 👍 / 👎.
71094f9 to
725ce1f
Compare
… smoke The production instrumentation hook requires a keyed query-hash secret so logged clinical queries are not reversible. CI boot smoke only checks that the server starts and reports the correct local project identity, so a non-production placeholder is sufficient (same pattern as service-role and OpenAI placeholders). Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
725ce1f to
c8e7baf
Compare
2 participants
Summary
Fixes Deployment boot smoke CI failure after #407 by supplying a min-16-char placeholder for
RAG_QUERY_HASH_SECRETwhen the env var is absent in CI.Change
scripts/deployment-boot-smoke.mjssets:This satisfies
instrumentation.tsrequireQueryHashSecret()during production boot smoke without exposing real secrets.Verification
main(includes docs(ui): catalog sourceCapsuleCountBadge after sources capsule redesign #428)npm run verify:cheappassed locally on this branch